Security, Encryption, and Key Management
Encryption and keys
Guardium can encrypt audit data at rest with AES-256. Keys are managed internally or through a KMIP key server such as IBM Guardium Key Lifecycle Manager. If the key server is unreachable, encrypted data cannot be read. Rotate keys on a schedule and back up key material separately from the appliance. Audit-data encryption is distinct from database-native TDE and from TLS in flight.
Transport and hardening
TLS protects S-TAP-to-collector, collector-to-aggregator, and CM-to-managed-unit traffic. Use CA-signed certificates; self-signed is acceptable only for labs. FIPS mode restricts cipher suites, and STIG-style hardening changes default accounts and services.
Worked example
Enable TLS for S-TAP: generate a CSR on the collector, sign it with the enterprise CA, import the certificate and chain, configure the S-TAP to require TLS, restart the tap, and verify the connection state. Confirm the collector still receives traffic and track certificate expiry in the monitoring calendar.
Traps
Confusing Guardium data encryption with database TDE; enabling FIPS and then wondering why legacy ciphers fail; letting certificates expire; storing the only key backup on the encrypted appliance.