Tag Info

Hot answers tagged

67

I like to store mine on paper. Using a JavaScript (read: offline) QR code generator, I create an image of my private key in ASCII armoured form, then print this off. Note alongside it the key ID and store it in a physically secure location. If you have a large key or lots of keys I recommend paperbak, although be sure to write down instructions on how to ...


21

I haven't thought through the details, but if a secure hash of the file content were used as the key then any (and only) clients who "knew the hash" would be able to access the content. Essentially the cloud storage would act as a collective partial (very sparse, in fact) rainbow table for the hashing function, allowing it to be "reversed". From the ...


20

The commercial ad you link to, and the company web site, are really short on information; and waving "20 patents" as a proof of competence is weird: patents do not prove that the technology is good, only that there are some people who staked a few thousand dollars on the idea that the technology will sell well. Let's see if there is a way to make these ...


19

On-site storage Fireproof safe/cabinet in a access controlled environment is often considered safe enough, It is manual labor to actually put the drives/tapes into the container. Example: Attached fireproof media container. An example here is SentrySafe. A cheaper example is ioSafe. Site redundancy. When you already have site redundancy for your ...


15

Bruce Schneier touched on the subject in May http://www.schneier.com/blog/archives/2011/05/dropbox_securit.html related to the Dropbox problem of that week. TechRepublic offers a great 7 page white paper on the subject for the price of an e-mail sign up at ...


13

For the sake of having some fun, I'm going to answer this question exactly wrong. Just to get some practice in pointy haired boss thinking. If this isn't appreciated I have no doubt a moderator will delete it and threaten me. First, have only one person responsible for backups, ever. This way when anything goes wrong you know who to blame. Next, have ...


12

Another one which causes more issues than you might expect is providing the backups with sufficient security. I have seen numerous instances where there was no protection of backups aside from being stored in a warehouse. This includes storing unencrypted customer account and password data! It makes it very easy for attackers - okay, they need to go back ...


11

I would say no its not suitable for storing criticial information, From the sound of their terms Google essentially owns everyting you upload as well as anything derivitive of your data as well. Here is an excerpt from the verge.com explaining the differences of the 3 major players, notice Google is very liberal with what they can do with your data. ...


11

The most sensible approach is to assume you cant rely on their privacy - it isn't their responsibility, although there are some services whose selling point is securing this data. If you take that stance, as long as you encrypt all data before it goes to the cloud you can be safe (decide on what level of encryption you need in order to be safe) This ...


11

Backing up the TrueCrypt container means that you'll end with a time line of your encrypted volume, and all of those versions share the same key. Have different versions of the container with the same key gives the adversary two advantages: Information leakage: The adversary will know which sectors of the volume changed. and, as a consequence, a compromise ...


10

You can keep your private key in a flash drive and keep this drive in a locker. Also, ensure that you don't use this flash drive for activities which might cause infecting it with some malware.


9

In addition to the other good answers here, I'd like to point you to the following two academic papers, which were published recently: Martin Mulazzani, Sebastian Schrittwieser, Manuel Leithner, Markus Huber, and Edgar Weippl, Dark Clouds on the Horizon: Using Cloud Storage as Attack Vector and Online Slack Space, Usenix Security 2011. This paper ...


9

A backup, if there is one, takes time to get restored, if it can be. In other words: Not every company has good backup practices. Considering that, as noted in the security investigation, UBS had other poor security practices it may not be surprising if they didn't have good backups. Even if a backup has been made it takes time to restore. During this time ...


9

Nothing can prevent physical items being stolen by a sufficiently determined adversary; even the British crown jewels have gone AWOL over the years, and they live in the Tower of London. What mitigates the risk, for me, is encrypting my backups. Most enterprise-grade backup software, including the excellent bacula, allow the encryption of backups. Once ...


9

Consider this from an Information Management or Information Assurance question rather than an Information Protection question. To the question if a service provider's level of security is "safe" (sufficient and appropriate), the answer is YES and NO - depending on the level of protection the specific information requires. My suggestion is you create three ...


9

One option is to encrypt your key using a passphrase, and store the encrypted key on a cloud service. I have the key on my laptop (hardware encrypted drive) and on a Truecrypt container on an external hard drive as backup. Ok, it's not zero risk of data loss, but it's down to a level that is acceptable to me.


7

Dropbox is compliant with the Data Protection Act, the main worry is point 8 of the Act: Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal ...


7

In the guise of one question, you're really needing the answer to two. How should one physically protect backups from theft? Which is covered quite well already. How should one protect the backups when they're stolen? When building out your solution you should always assume that your physical protections will fail. Sometimes this can be due to a ...


7

Yes, it is very easy to retrieve data if you have the tape. The only challenge with older tapes is ensuring you have an appropriate reader. Once you have the reader you can easily work out what operating system and backup application write to the tape. You must treat backups the same way you treat live data. If it is sensitive, use controls such as ...


7

for example, if my laptop is stolen and my house is exploded I suggest that the initial test run involve renting a safe deposit box at a nearby bank to do your offsite backup storage in. This is probably the best answer as well. If you want to get fancy, get a larger safe deposit box and pack the HD in an anti-static bag, then in a small layer of ...


6

There's several reasons deletion of production data, especially by a malevolent sysadmin, will have a significant impact on a company - with or without backups: Many companies don't do backups, or don't do them right. Without good backups, you may not ever be able to recover data that's been nuked by a sysadmin. Companies that do have backups don't always ...


6

The question is now "how can I do file level synchronization between two open TrueCrypt containers on a single host without any local leakage of data from the sync tool?". The answer is you probably can't - certainly none of the well established file sync tools (unison, rsync, SyncToy, etc.) promise not to have such leaks. Their focus is purely on being ...


5

You need just the most recent copy of the data, or a historic backup, like version control? supposing you have two computers running linux (easier) or even any other OS that have the needed tools implemented and you want only the latest backup: install SSH and create a tunnel between the two computers. You can choose to use the strongest key you need ...


5

The same question was asked at the cryptography stack exchange. Please see my answer there, as there is a subtlety that is easy to overlook and that has been carefully analyzed by the Tahoe-LAFS open source project: http://crypto.stackexchange.com/questions/729/is-convergent-encryption-really-secure/758#758


5

Encryption and de-duplication between arbitrary users are not compatible if you are concerned about distinguishing certain plaintexts. If you are not concerned about these types of attacks, then it can be safe. If the data is only de-duplicated for a certain user, the server doesn't know anything about the equivalence of plaintexts and the attacks that ...


5

no, you could be MITM'd unless you're using AD and/or IPsec passwords are encrypted the data is in the clear yep, it's a nightmare to keep on top of Windows SMB/CIFS holes. You also have to watch for being brute-forced. Even if you limit it to one account, that account has access to all the data, and privilege escalation on SMB is not unheard of. The ...


5

I'd say that the PCI compliance aspect is going to complicate things more than a little bit and that you should really speak to your QSA about requirements. Whilst I'm not a QSA it would seem to me that if you backup card data then that backup service would effectively become part of your cardholder data environment. Apart from that one thing I always look ...



Only top voted, non community-wiki answers of a minimum length are eligible