Page Comparison

This article explains what Vormetric GuardPoints are and how GuardPoints can be used to protect and encrypt data.

Video Tutorial

...

Widget Connector

overlay	youtube
_template	com/atlassian/confluence/extra/widgetconnector/templates/youtube.vm
width	400px
url	https://www.youtube.com/watch?v=sWszjVFGI-Q
height	300px

Prerequisites

...

Before you begin, you must:

Understand how the Vormetric product works.
Review and follow the Introduction to Vormetric Data Security Manager and Create a Starter Policy with Learn Mode topics.

What are GuardPoints?

...

A GuardPoint is a folder or directory path that Vormetric protects and controls. Once a policy is selected and applied to a folder, that path is considered a GuardPoint.

Note

Keep in mind the following notes about GuardPoints:

Once a folder becomes a GuardPoint, the policy assigned to that GuardPoint will control what can access that GuardPoint.
The policy that controls access to the GuardPoint does not replace the operating system permissions; however, the policy can replace the operating system permissions.
Applying a Guard Point to a folder does not mean the data inside is encrypted.
- The data will need to be encrypted by one of two methods, Copy Method or Data Transformation.

Guarding Data vs. Encrypting Data

...

Note

Before you follow the Copy Method, you must:

Create a new folder on your virtual machine outside of the intended GuardPoint. All data inside the intended GuardPoint will be moved temporarily into this temporary folder.
Processes and users that are accessing the intended GuardPoint will need to be stopped, such as databases, open files, user sessions, etc.
You will need to have at least one Learn Mode policy already configured.

The encryption agent on the host machine needs exclusive rights to the folder in order to successfully guard (or unguard) a folder via the Data Security Manager (DSM) console.

To encrypt data via the Copy Method:

Log into the DSM as a Security Administrator.
Stop all processes and users on the host machine from accessing the intended GuardPoint.
On the host machine, move all data out of the intended GuardPoint into a temporary folder.
Note
Make sure that folder permissions have not changed. The move-and-copy process can sometimes alter file/folder permissions.
In the top menu, click Hosts, and then click the host name of the machine where you want to create a GuardPoint.

Image Modified
Click the Guard FS tab.
- If you have other GuardPoints configured on this machine, those GuardPoints will be listed here.

...

Image Added
Click the Guard button.

Image Modified
In Policy, select the desired policy.

Image Modified
Click Browse to remotely access the directory structure of the host machine.
Locate and select the folder to guard, and then click OK. If you do not see the OK button, you may need to scroll down.

Image Modified
Confirm the desired directory path, and then click OK.

Image Modified
The newly created GuardPoint will be listed and contain a red status in a table with other GuardPoints. Click Refresh to manually refresh the screen. When the GuardPoint has been pushed into the machine, the status will turn green.

Image Modified
After the status turns green, copy the data back into the GuardPoint.
- If the status does not turn green, there may be a person or process still accessing the folder. The encryption key that is applied in the Learn Mode policy will encrypt the data as the data is being transferred back into the GuardPoint.
- If you copy the data, you still have a clear text copy of the data in the temporary folder. After you confirm that services are running as expected, you can delete the temporary folder.
The next steps will include tuning the policy and will be covered in another article.