5 ms·

If you don’t trust them with your data, you can encrypt it with your own keys.

briffle 6y ago
Really, someone just did that for them, for the bargain price of $1.4M. I'm guessing they saved at least that much by outsourcing their entire IT department a few years ago.
- znpy 6y ago
  This is really the best possible answer. you just did the root cause analysis for them too (you should send them an invoice). Nothing new, in a way: cut the spending on IT, lower quality, get incidents. Meh.
AnthonyMouse 6y ago
But then you lose the main advantages of using them to begin with. It becomes harder to use, it may not be able to do efficient differential backups or snapshots anymore or require you to do some complicated thing to make it work because their interface isn't meant to be used that way etc. And if it's actually important for the data to remain private, you then have to get the cryptography right, not think that your backups are "encrypted" because you used TLS, or use some snake oil encryption software which is using export ciphers or bad random number generation or anything like that. In-house backups aren't that hard. The hardest thing is to make sure everything is getting backed up that ought to be, and actually test that it is, which is no different with cloud backups.
- throw0101a 6y ago
  > But then you lose the main advantages of using them to begin with. Poppycock. There's plenty of software that can do encrypted incrementals / differentials: Commvault, NetBackup, Veeam, tarsnap, Duplicity, ZFS snapshot send-recv,
  - AnthonyMouse 6y ago
    You're asserting that these things are as easy to use as keeping all your junk on a shared Google Drive or whatever it is many companies are currently doing? They all require you to have a level of technical competence equivalent to what would be needed to implement the backups yourself.
    - throw0101a 6y ago
      If you're talking about something that is worth paying US$ 1M in ransom, then paying someone a few (tens of) thousands in cost centre chargebacks upfront, and probably an ongoing annual fee, is cheap insurance if you want to go with the 'enterprise software'. And if you want 'consumer software' that offers cloud / offsite encrypted back, then Backblaze offers it in a very clicky-clicky fashion that most folks can handle with a bit of hand-holding: * https://help.backblaze.com/hc/en-us/articles/217664688-Can-you-tell-me-more-about-the-encryption-Backblaze-uses- https://help.backblaze.com/hc/en-us/articles/217664688-Can-y... As does Arq, with a documented file format: * https://www.arqbackup.com/arq_data_format.txt https://www.arqbackup.com/arq_data_format.txt Every cloud-capable backup system (for consumers and enterprises) does encryption nowadays, so talking about 'data access' in the cloud is a straw man.
      - justinclift 6y ago
        If you really want to include NetBackup in that list, then for a real world deployment you'll generally be looking at more than US$1M+. Assuming it's for an actual enterprise or at least large dept. Source: Used to be a NetBackup engineer on enterprise accounts :)
        throw0101a 6y ago
        I've included more and less cost options in the list to counter the very argument that you seem to be attempting to make. How much productivity was lost from many dozens of people not being able to work because of lack of access, the IT resources that had to be extended to investigate the various options, and then the US$ 1M ransom eventually paid out. For Want of a Nail: * https://en.wikipedia.org/wiki/For_Want_of_a_Nail https://en.wikipedia.org/wiki/For_Want_of_a_Nail
- znpy 6y ago
  eh, there's no free lunch.

Really, someone just did that for them, for the bargain price of $1.4M. I'm guessing they saved at least that much by outsourcing their entire IT department a few years ago.

znpy 6y ago
This is really the best possible answer. you just did the root cause analysis for them too (you should send them an invoice). Nothing new, in a way: cut the spending on IT, lower quality, get incidents. Meh.

AnthonyMouse 6y ago

But then you lose the main advantages of using them to begin with. It becomes harder to use, it may not be able to do efficient differential backups or snapshots anymore or require you to do some complicated thing to make it work because their interface isn't meant to be used that way etc. And if it's actually important for the data to remain private, you then have to get the cryptography right, not think that your backups are "encrypted" because you used TLS, or use some snake oil encryption software which is using export ciphers or bad random number generation or anything like that. In-house backups aren't that hard. The hardest thing is to make sure everything is getting backed up that ought to be, and actually test that it is, which is no different with cloud backups.

throw0101a 6y ago
> But then you lose the main advantages of using them to begin with. Poppycock. There's plenty of software that can do encrypted incrementals / differentials: Commvault, NetBackup, Veeam, tarsnap, Duplicity, ZFS snapshot send-recv,
- AnthonyMouse 6y ago
  You're asserting that these things are as easy to use as keeping all your junk on a shared Google Drive or whatever it is many companies are currently doing? They all require you to have a level of technical competence equivalent to what would be needed to implement the backups yourself.
  - throw0101a 6y ago
    If you're talking about something that is worth paying US$ 1M in ransom, then paying someone a few (tens of) thousands in cost centre chargebacks upfront, and probably an ongoing annual fee, is cheap insurance if you want to go with the 'enterprise software'. And if you want 'consumer software' that offers cloud / offsite encrypted back, then Backblaze offers it in a very clicky-clicky fashion that most folks can handle with a bit of hand-holding: * https://help.backblaze.com/hc/en-us/articles/217664688-Can-you-tell-me-more-about-the-encryption-Backblaze-uses- https://help.backblaze.com/hc/en-us/articles/217664688-Can-y... As does Arq, with a documented file format: * https://www.arqbackup.com/arq_data_format.txt https://www.arqbackup.com/arq_data_format.txt Every cloud-capable backup system (for consumers and enterprises) does encryption nowadays, so talking about 'data access' in the cloud is a straw man.
    - justinclift 6y ago
      If you really want to include NetBackup in that list, then for a real world deployment you'll generally be looking at more than US$1M+. Assuming it's for an actual enterprise or at least large dept. Source: Used to be a NetBackup engineer on enterprise accounts :)
      - throw0101a 6y ago
        I've included more and less cost options in the list to counter the very argument that you seem to be attempting to make. How much productivity was lost from many dozens of people not being able to work because of lack of access, the IT resources that had to be extended to investigate the various options, and then the US$ 1M ransom eventually paid out. For Want of a Nail: * https://en.wikipedia.org/wiki/For_Want_of_a_Nail https://en.wikipedia.org/wiki/For_Want_of_a_Nail
znpy 6y ago
eh, there's no free lunch.