Security
Suggest changes
PDFs
Cloud Volumes ONTAP supports data encryption and provides protection against viruses and ransomware.
Encryption of data at rest
Cloud Volumes ONTAP supports the following encryption technologies:
-
NetApp encryption solutions (NVE and NAE)
-
AWS Key Management Service
-
Azure Storage Service Encryption
-
Google Cloud Platform default encryption
You can use NetApp encryption solutions with native encryption from AWS, Azure, or GCP, which encrypt data at the hypervisor level. Doing so would provide double encryption, which might be desired for very sensitive data. When the encrypted data is accessed, it’s unencrypted twice—once at the hypervisor-level (using keys from the cloud provider) and then again using NetApp encryption solutions (using keys from an external key manager).
NetApp encryption solutions (NVE and NAE)
Cloud Volumes ONTAP supports both NetApp Volume Encryption (NVE) and NetApp Aggregate Encryption (NAE) with an external key manager. NVE and NAE are software-based solutions that enable (FIPS) 140-2–compliant data-at-rest encryption of volumes.
-
NVE encrypts data at rest one volume a time. Each data volume has its own unique encryption key.
-
NAE is an extension of NVE—it encrypts data for each volume, and the volumes share a key across the aggregate. NAE also allows common blocks across all volumes in the aggregate to be deduplicated.
Both NVE and NAE use AES 256-bit encryption.
Starting with Cloud Volumes ONTAP 9.7, new aggregates will have NetApp Aggregate Encryption (NAE) enabled by default after you set up an external key manager. New volumes that aren't part of an NAE aggregate will have NetApp Volume Encryption (NVE) enabled by default (for example, if you have existing aggregates that were created before setting up an external key manager).
Setting up a supported key manager is the only required step. For set up instructions, see Encrypting volumes with NetApp encryption solutions.
AWS Key Management Service
When you launch a Cloud Volumes ONTAP system in AWS, you can enable data encryption using the AWS Key Management Service (KMS). Cloud Manager requests data keys using a customer master key (CMK).
|
You can't change the AWS data encryption method after you create a Cloud Volumes ONTAP system. |
If you want to use this encryption option, then you must ensure that the AWS KMS is set up appropriately. For details, see Setting up the AWS KMS.
Azure Storage Service Encryption
Azure Storage Service Encryption for data at rest is enabled by default for Cloud Volumes ONTAP data in Azure. No setup is required.
You can encrypt Azure managed disks on single node Cloud Volumes ONTAP systems using external keys from another account. This feature is supported using Cloud Manager APIs.
You just need to add the following to the API request when creating the single node system:
"azureEncryptionParameters": {
"key": <azure id of encryptionset>
}
|
Customer-managed keys are not supported with Cloud Volumes ONTAP HA pairs. |
Google Cloud Platform default encryption
Google Cloud Platform data-at-rest encryption is enabled by default for Cloud Volumes ONTAP. No setup is required.
While Google Cloud Storage always encrypts your data before it's written to disk, you can use Cloud Manager APIs to create a Cloud Volumes ONTAP system that uses customer-managed encryption keys. These are keys that you generate and manage in GCP using the Cloud Key Management Service. Learn more.
ONTAP virus scanning
You can use integrated antivirus functionality on ONTAP systems to protect data from being compromised by viruses or other malicious code.
ONTAP virus scanning, called Vscan, combines best-in-class third-party antivirus software with ONTAP features that give you the flexibility you need to control which files get scanned and when.
For information about the vendors, software, and versions supported by Vscan, see the NetApp Interoperability Matrix.
For information about how to configure and manage the antivirus functionality on ONTAP systems, see the ONTAP 9 Antivirus Configuration Guide.
Ransomware protection
Ransomware attacks can cost a business time, resources, and reputation. Cloud Manager enables you to implement the NetApp solution for ransomware, which provides effective tools for visibility, detection, and remediation.
-
Cloud Manager identifies volumes that are not protected by a Snapshot policy and enables you to activate the default Snapshot policy on those volumes.
Snapshot copies are read-only, which prevents ransomware corruption. They can also provide the granularity to create images of a single file copy or a complete disaster recovery solution.
-
Cloud Manager also enables you to block common ransomware file extensions by enabling ONTAP's FPolicy solution.
