4 ms·

> A hard disk is lost during transit, somehow ? No data is stolen. Arguably, customer data should not leave a secure location on a physical disk. If you want t

> A hard disk is lost during transit, somehow ? No data is stolen. Arguably, customer data should not leave a secure location on a physical disk. If you want to move your server, backup the data, wipe the disk, move the server/disk/etc, and then put the data back on the disk once it is back in a secure location. The author mentions this in the article - define a secure boundary, don't let the data exit that boundary unencrypted.

yjftsjthsd-h 2y ago
> Arguably, customer data should not leave a secure location on a physical disk. Okay, let's argue. Under what threat model is it a problem to transport sensitive data on encrypted disks?
- forty 2y ago
  Maybe "they can replace the disk firmware during transport while the driver was peeing" kind of attackers?
  - yjftsjthsd-h 2y ago
    That doesn't have anything to do with the customer's data and isn't helped by the suggestion of wiping the drives before transport. The data is encrypted no matter what happens to firmware; that is at best a way to compromise the server(s) after transport.
- spydum 2y ago
  If the device is lost or stolen during transport physically, all it takes is the attacker to gain control of the key, or find a weakness in that firmware or encryption method. While those are stupidly improbable, the reality is once you lose physical custody, the attacker has a lot more options.
brongondwana 2y ago
Never underestimate the bandwidth of a stationwagon loaded with tapes. Arguably, your position is bogus. Why cause a bunch of extra copying around to move a server. "Back up" indeed - to what? Another disk? It's turtles all the way down.
- redleader55 2y ago
  > Never underestimate the bandwidth of a stationwagon loaded with tapes. I don't. I know it has amazing bandwidth and it might be a lot faster than network transfer. > Arguably, your position is bogus. That's not nice. > Why cause a bunch of extra copying around to move a server. "Back up" indeed - to what? Another disk? It's turtles all the way down. Yes, to another disk, in the same data-center or in another one. If the data is encrypted end-to-end, it might be better to transfer it to another data center than to move the data between data-centers on physical disks for security reasons. It's less likely that an adversary is able to execute an attack where it is able to pin-point the exact moment and the exact data they want is being backed up between data centers. On the other hand, organizing a heist of a few trucks filled with physical storage leaving the data center might be easier to pull. In these two scenarios we expect the encryption to be equally hard to crack for data at rest and data in transit, which is usually not true for performance reasons.
JackSlateur 2y ago
How do you "wipe the disk" ? Serious question: is there a sane, working, single solution to ensure that ? Flash-based devices are so complicated (versus the old rusty devices) Anyway, this sound exhausting
- CiPHPerCoder 2y ago
  If you're using a secure disk encryption technology, and you manage to clear the keys from the TPM or overwrite the header containing the KDF salts and other metadata, that should render the device data unrecoverable.

yjftsjthsd-h 2y ago

> Arguably, customer data should not leave a secure location on a physical disk. Okay, let's argue. Under what threat model is it a problem to transport sensitive data on encrypted disks?

forty 2y ago
Maybe "they can replace the disk firmware during transport while the driver was peeing" kind of attackers?
- yjftsjthsd-h 2y ago
  That doesn't have anything to do with the customer's data and isn't helped by the suggestion of wiping the drives before transport. The data is encrypted no matter what happens to firmware; that is at best a way to compromise the server(s) after transport.
spydum 2y ago
If the device is lost or stolen during transport physically, all it takes is the attacker to gain control of the key, or find a weakness in that firmware or encryption method. While those are stupidly improbable, the reality is once you lose physical custody, the attacker has a lot more options.

brongondwana 2y ago

Never underestimate the bandwidth of a stationwagon loaded with tapes. Arguably, your position is bogus. Why cause a bunch of extra copying around to move a server. "Back up" indeed - to what? Another disk? It's turtles all the way down.

redleader55 2y ago
> Never underestimate the bandwidth of a stationwagon loaded with tapes. I don't. I know it has amazing bandwidth and it might be a lot faster than network transfer. > Arguably, your position is bogus. That's not nice. > Why cause a bunch of extra copying around to move a server. "Back up" indeed - to what? Another disk? It's turtles all the way down. Yes, to another disk, in the same data-center or in another one. If the data is encrypted end-to-end, it might be better to transfer it to another data center than to move the data between data-centers on physical disks for security reasons. It's less likely that an adversary is able to execute an attack where it is able to pin-point the exact moment and the exact data they want is being backed up between data centers. On the other hand, organizing a heist of a few trucks filled with physical storage leaving the data center might be easier to pull. In these two scenarios we expect the encryption to be equally hard to crack for data at rest and data in transit, which is usually not true for performance reasons.

JackSlateur 2y ago

How do you "wipe the disk" ? Serious question: is there a sane, working, single solution to ensure that ? Flash-based devices are so complicated (versus the old rusty devices) Anyway, this sound exhausting

CiPHPerCoder 2y ago
If you're using a secure disk encryption technology, and you manage to clear the keys from the TPM or overwrite the header containing the KDF salts and other metadata, that should render the device data unrecoverable.