An organization currently writes backups to an EMC Data Domain system and then creates encrypted copies of their backups on tapes. These tapes are then shipped to a third-party offsite vault.
They are now planning to deploy a second Data Domain system in a hosted disaster recovery site as a replication target. This will replace the use of the offsite tapes. The two sites are connected through an encrypted WAN link.
Where should encryption be applied on the Data Domain systems to ensure a similar level of data security as their current process?