4 ms·
It’s not the backup, it’s the -restoration-. TheBadGuy changes the encryption key used to make the backups, then waits %long enough%, you’re still boned.
by Damogran6 5y ago
It’s not the backup, it’s the -restoration-.
TheBadGuy changes the encryption key used to make the backups, then waits %long enough%, you’re still boned.
- monocasa 5y agoThere's no perfect scheme, but the best mechanisms I've seen for this in practice involve HSMs so that nobody, bad guy or good guy, can change the keys used for encryption without physically pulling the module, and it can be disconnected and stored at a safe location once the backup is complete. Each redundant set of a backup has an HSM, and the HSMs are cold stored in different physical locations. But yes, this is hard to get right as I hinted by the "but not impossible" quip.
- hughrr 5y agoMany years ago I was working for a defence contractor and an idiot hit the TOTAL ERASE button on an HSM. This all went to hell when no one could work out how to load the keys into it again for nearly two weeks...
- bradknowles 5y agoThe storage of the backup medium should be in write-only mode. So, once written, they cannot be changed. That will help.
- Melatonic 5y agoCouldn't you just NOT encrypt your tape backups?
- monocasa 5y agoPractically you don't want to do that. You want them to be useless to someone who steals a tape since it could be a long time to never before you realize it's gone. All the tapes on the shelf look alike.
- Damogran6 5y agoAnd it probably contains ALL your secrets. Financials, Staff, R&D, Data encumbered by Federal Standards requirements...
- worik 5y agoEncrypt some files. Encrypting the complete backup is working against the purpose of backups, making it harder for a small, if existent, gain in security
- monocasa 5y agoNo, you encrypt at the tape drives themselves typically. Part of how they work is the also compress at the drive, but if you encrypt first there's no common entropy and the compression techniques work against you. And picking and choosing is a recipe for disaster when something inevitably slips through and is leaked. Encrypt it all from orbit and let god sort it out.
- PakG1 5y agoSince the tapes are physical, can't you protect them using different strategies? Like how banks protect stuff contained in safe deposit boxes? I imagine the stuff stored in safe deposit boxes can be quite sensitive too.
- lmm 5y agoThe insurance limit for a safe deposit box is surprisingly low. There just isn't a way to protect them well enough for really valuable things.
- roywiggins 5y agoThat and banks don't seem to really try very hard nowadays, at least for retail customers. Maybe rich people have access to a better class of safe deposit boxes. https://www.nytimes.com/2019/07/19/business/safe-deposit-box-theft.html https://www.nytimes.com/2019/07/19/business/safe-deposit-box... https://www.nbclosangeles.com/news/safe-deposit-box-theft-missing-items-wells-fargo-bank/2112715/ https://www.nbclosangeles.com/news/safe-deposit-box-theft-mi... https://www.dailyrecord.co.uk/news/scottish-news/widow-heartbroken-after-rbs-lose-25096477 https://www.dailyrecord.co.uk/news/scottish-news/widow-heart...