8456ch_Configflow.fm Draft Document for Review December 5, 2019 4:33 pm 10.4 Network security 10.5 Configuration flow 258  IBM DS8900F Architecture and Implementation GLYPH<SM590000> IBM Fibre Channel Endpoint Security (IFCES): Use this feature to encrypt data as it is  transmitted between your IBM Z server and DS8900F. This encryption mechanism also  uses external key servers. It can be enabled at any time. GLYPH<SM590000> Transparent Cloud Tiering (TCT): The DS8900F also provides support to encrypt data  being transferred to the cloud, when using the TCT function. TCT encryption can be  enabled at any time, and relies on external key managers. GLYPH<SM590000> The first component is Internet Protocol Security (IPSec), and for Gen-2 security, IPsec-v3  is required. IPSec protects the network communication at the Internet layer, or the packets  that are sent over the network. This configuration ensures that a valid workstation or  server communicates with the HMC and that the communication between them cannot be  intercepted. GLYPH<SM590000> The second component is Transport Layer Security (TLS) 1.2, which provides protection at  the application layer to ensure that valid software (external to the HMC or client) is  communicating with the software (server) in the HMC.  This section shows the list of tasks to perform when storage is configured in the DS8900F.  Depending on the environment and requirements, not all tasks might be necessary.  Logical configuration can be performed by using the DS GUI, DS CLI, or a combination of  both. Depending on your preference and experience, one method might be more efficient  than the other. The DS8900F GUI provides a powerful, yet simple process for logical  configuration. If you use the DS GUI, not all of the steps that are listed in this book are  Note:  The details for implementing and managing security requirements are provided in  IBM DS8870 and NIST SP 800-131a Compliance , REDP-5069. Two components are required to provide full network protection:  The security of the network that is used to communicate to and manage the DS8900F  (specifically the HMC) is important, depending on the client requirements. The DS8900F  supports compliance to the National Institute of Standards and Technology (NIST)  SP800-131a standards.  The current DS8900F encryption solution requires the use of an external key manager. The  key manager is used in generating, protecting, storing, and maintaining encryption keys that  are needed to encrypt information. For more information, including current considerations and preferred practices for DS8900F  encryption, see 7.3.6, “Key manager servers for encryption” on page 199 and IBM DS8000 Encryption for data at rest and Transparent Cloud Tiering, and Endpoint  Security , REDP-4500.  For more information about encryption license considerations, see “Encryption activation  review planning” on page 199. standard on the DS8900F. However, Full disk encryption offerings must be activated  before performing any logical configuration.