I'm a system admin with little security experience. I want to schedule the copying of our backups to protect our data in case of fire. The best solution would be to copy the data onto a new hard-disk and lock it in a safe. Practically, however, the chances of someone doing this regularly are slim. I therefore want to automate the copy to a computer/hard-disk that is far away from the building.
The data is very sensitive and the chances of a sophisticated attack are considered to be fairly high. I am therefore looking for solution that has very limited functionality. This is largely to prevent myself (or a system admin in the future) misconfiguring the solution in ignorance. In short, I want my server to be able to communicate to a well defined external computer and only this computer. Is this something that is possible to guarantee?
The company cannot afford a leased telephone line, which is the only way I currently think of to achieve this aim. (I worry, for example, that a VPN has too great a functionality, and causes me to become a security risk.)
Currently the office server (that makes the backups) is isolated from the internet. Desktop users (who do have the internet) have access to only low privilege accounts on the server. I would like to keep the server and the backup server as isolated from the internet as possible - allowing only the scheduled copy to be communicated to the outside world. Is there any alternative to VPN for this?
Finally, since the server in the distant location is only required to copy the backup onto a hard-disk - is there a way of locking this system down so that only transmitted documents are saved to the hard disk (preventing malware from accidently being installed).
Currently all the solutions seems that I have found involve either VPN or a leased telephone line. I think the first is far from foolproof and I can't afford the second. Any advice welcome.
EDIT: I'm not discounting using VPN, but I would need to convice myself (and my supervisors) that this method is near idiot proof. This is because I have not used this technology before.