05-29-2012 05:24 PM
Does anyone have experience using BitLocker in Windows 7 for your SAS data drives? Have you seen a performance impact? We work with large files with significant I/O.
We looked at self-encrypting hard drives, but they are out of stock, so BitLocker seemed like an alternative.
05-30-2012 03:07 PM
This is what I was able to find so far regarding BitLocker:
How it might effect the Install:
We have seen cases where encyption software blocks the installation and configuration process for SAS.
We have also seen cases, where the install may go okay, but then SAS will crash when you try to perform
an initial launch after installing for the first time. With that said, we typically recommend that any encryption
software be completely disabled or turned off prior to deploying SAS software.
Please read this short overview in the documentation on SAS/SECURE and SAS Encryption here: http://support.sas.com/documentation/cdl/en/secref/62092/HTML/default/viewer.htm#cryptotopic.htm
Using 3rd party encryption with or without SAS Encryption is going to cause SAS to be slower or crash.
SAS Technical Support does not have any type of official statement regarding support and use of SAS 9.2 or SAS 9.3 on
Windows 7 Bitlocker, or any other encryption software package. However, we have seen cases
specifically where Bitlocker will block the installation\configuration process for SAS, or prevent SAS from launching.
How it might effect performance:
SAS will most likely have a problem reading the data in the encrypted folder. While we do not have an official response regarding the use of third party encryption software with SAS we have seen many instances where SAS was not able to read the encrypted data set or file. Using 3rd party encryption software such as Bitlocker most probably not have a positive impact on SAS performance. In some cases it is severe enough to cause I/O errors and crash the SAS program. If you feel strongly about using Bitlocker you may want to first test the interaction with SAS to determine whether or not you will encounter a problem and if it will work in your environment. If there is a problem with using SAS with Bitlocker it is not something that SAS technical support can resolve or support.
SAS/Secure will not encrypt the folder. SAS/Secure provides the following types of encryption:
Over-the-wire encryption protects SAS data and data while in transit. Passwords in transit to and from SAS servers are encrypted or encoded.
On-disk encryption protects data at rest. Passwords in configuration files and the metadata are encrypted or encoded. Configuration files and metadata repository data sets are also host protected.
I hope this information is helpful.
Have a wonderful day, Sunshine
06-11-2012 09:10 AM
Not quite on topic. We use PGP whole disk encryption on all of our laptops and have seen no instances in which it caused SAS to crash or have problems during an install. Although we saw a minor degradation in performance in a controlled (test) environment, it is not noticeable in production (where network traffic causes more variability than encryption).
10-11-2012 10:35 AM
I have not specifically tested Bitlocker, although I use SAS on a with it running on the entire PC. I did test the encryption delivered with Windows XP extensively before implementing it across a large number of PCs. We did not use SAS for the test. We did not find any difference in our file-intesive benchmarks. This is to be expected because the file i/o is limited by disk speed, encryption does not increase the file size and the Bitlocker processing is in the CPU. If you are running heavy computing in parallel with disk i/o, you might see an effect, unless you have several CPU cores.
On the SAS reponse saying that Bitlocker must be switched off for installation: this is not acceptable in my company. Bitlocker is ALWAYS on EVERY PC. I can see no technical reason why it should affect SAS as it is supposed to be transparent to applications. Having said that, SAS is unreliable on my Windows 7 machines: fails to start, crashes on start with file access errors (to profile). It could be the virus scanner or the execution protection. SAS needs to make their software run in a secure environment as that is the default in any organisation which takes digital threats seriously today.
10-12-2012 10:02 AM
My suspicion is that the SAS recommendation is for the minimum processor configuration (which is terribly poor).
We used to have trouble with our virus protection software when installing SAS which, like Bitlocker, has CPU impact, but supposedly not disk impact. The problem was that the SAS install consists of over 10,000 different files. The CPU was swamped by the virus checking and the SAS install crashed.
Now that we have moved on to faster, multicore, processors, that problem has gone away.
We use SAS extensively on WDE PCs and Macs (Semantec's PGP on XP, Win 7, Mac OS) without unencrypting for the install.
10-12-2012 10:31 AM
I have not had problems installing; only afterwards running SAS. I have 4-core fairly new PCs with Windows 7. It was OK with a much slower 2-core PC under Windows XP. But then we upgrade our PCs only so we can run more security software, not to get more useful work done ;-).