Hot answers tagged

99

I like to store mine on paper. Using a JavaScript (read: offline) QR code generator, I create an image of my private key in ASCII armoured form, then print this off. Note alongside it the key ID and store it in a physically secure location. If you have a large key or lots of keys I recommend paperbak, although be sure to write down instructions on how to ...


39

I'm not sure about Google Drive, but Dropbox provides a way to recover previous file versions, a feature that wouldn't be impacted by the ransomware, since it relies on a file copies on the Dropbox servers. So it'd certainly be a way of protecting your data. However, recovering everything over your internet connection is a relatively slow process. ...


25

I haven't thought through the details, but if a secure hash of the file content were used as the key then any (and only) clients who "knew the hash" would be able to access the content. Essentially the cloud storage would act as a collective partial (very sparse, in fact) rainbow table for the hashing function, allowing it to be "reversed". From the ...


21

The commercial ad you link to, and the company web site, are really short on information; and waving "20 patents" as a proof of competence is weird: patents do not prove that the technology is good, only that there are some people who staked a few thousand dollars on the idea that the technology will sell well. Let's see if there is a way to make these ...


19

On-site storage Fireproof safe/cabinet in a access controlled environment is often considered safe enough, It is manual labor to actually put the drives/tapes into the container. Example: Attached fireproof media container. An example here is SentrySafe. A cheaper example is ioSafe. Site redundancy. When you already have site redundancy for your ...


18

Backing up the TrueCrypt container means that you'll end with a timeline of your encrypted volume, and all of those versions share the same key. Having different versions of the container with the same key gives the adversary two advantages: Information leakage: The adversary will know which sectors of the volume changed. and, as a consequence, a ...


18

Simple, cheap and relatively scalable solution (Although I'm aware it has nothing with online storage to do) I have two USB drives that I rotate regularly (you can add a reminder in your calendar if you're afraid to do so). You can use one of the many synchronization tools to choose which folders should be copied, I use Allway Sync. One of the drive is ...


16

The most sensible approach is to assume you cant rely on their privacy - it isn't their responsibility, although there are some services whose selling point is securing this data. If you take that stance, as long as you encrypt all data before it goes to the cloud you can be safe (decide on what level of encryption you need in order to be safe) This ...


15

Bruce Schneier touched on the subject in May http://www.schneier.com/blog/archives/2011/05/dropbox_securit.html related to the Dropbox problem of that week. TechRepublic offers a great 7 page white paper on the subject for the price of an e-mail sign up at ...


15

Likely the best option in this kind of scenario is to record the password/passphrase in a physically secure location (e.g. bank vault, safe deposit box). Relying on human memory to record this kind of information for 10+ years is an extremely bad idea. For example the person who knows the passphrase leaves the comapny/gets hit by a bus/forgets it. Writing ...


15

At the time of writing, Dropbox would be a good way to mitigate ransomware attacks because a 30 day version history of file changes is kept on their servers (even on the free tier). This, depending on the volume of data, requires a fast internet connection for both upload and download for it to be effective. However, (big caveat) it wouldn't take much for ...


15

What would you recommend as backup strategy to avoid Ransomware? Read Only Storage The simplest solution covers 90% of the average person's data preservation needs: store your old data in a read-only format. How much of your data is old tax information, resources from past schools/jobs, photos from vacations, or any other type of information that ...


14

For the sake of having some fun, I'm going to answer this question exactly wrong. Just to get some practice in pointy haired boss thinking. If this isn't appreciated I have no doubt a moderator will delete it and threaten me. First, have only one person responsible for backups, ever. This way when anything goes wrong you know who to blame. Next, have ...


13

It's kind of scary that only one answer here mentions the verification of the backups so I felt the urge to add this answer: Whatever you chose as a backup strategy: Your backups are worth absolutely nothing if you don't have a working and well tested verification mechanism to check the integrity of the files. It's just a matter of time until ransomware ...


12

I would say no its not suitable for storing criticial information, From the sound of their terms Google essentially owns everyting you upload as well as anything derivitive of your data as well. Here is an excerpt from the verge.com explaining the differences of the 3 major players, notice Google is very liberal with what they can do with your data. ...


12

Another one which causes more issues than you might expect is providing the backups with sufficient security. I have seen numerous instances where there was no protection of backups aside from being stored in a warehouse. This includes storing unencrypted customer account and password data! It makes it very easy for attackers - okay, they need to go back ...


12

You can keep your private key in a flash drive and keep this drive in a locker. Also, ensure that you don't use this flash drive for activities which might cause infecting it with some malware.


12

On the days when my paranoia is like a ripe tomato, begging me to pick it, I split the private key (naturally it is already passphrase-protected) in half, then make a 3rd string by XOR-ing them together. Then I use simple password encryption (gpg --symmetric) on each string, and put each on a remote server on a different continent. Ideally, each remote ...


12

When trying to access the content of a hard-drive, you have to use the interface provided by said hard-drive. It usually comes with a firmware. Currently, it is stated that this firmware will not allow data to be read without providing the correct password and that in case of 10 failed attempts, the data would be deleted. To circumvent the restriction, ...


11

One option is to encrypt your key using a passphrase, and store the encrypted key on a cloud service. I have the key on my laptop (hardware encrypted drive) and on a Truecrypt container on an external hard drive as backup. Ok, it's not zero risk of data loss, but it's down to a level that is acceptable to me.


10

I feel like random people on the internet are not going to be able to answer this for you. This is a business decision. How valuable is the data? What is the risk of loss / corruption vs the cost of more disk space? Imagine your worst disaster-recovery scenario, how far back would you need to go to get a clean snapshot? I certainly can't answer any of this ...


9

In addition to the other good answers here, I'd like to point you to the following two academic papers, which were published recently: Martin Mulazzani, Sebastian Schrittwieser, Manuel Leithner, Markus Huber, and Edgar Weippl, Dark Clouds on the Horizon: Using Cloud Storage as Attack Vector and Online Slack Space, Usenix Security 2011. This paper ...


9

Consider this from an Information Management or Information Assurance question rather than an Information Protection question. To the question if a service provider's level of security is "safe" (sufficient and appropriate), the answer is YES and NO - depending on the level of protection the specific information requires. My suggestion is you create three ...


9

A backup, if there is one, takes time to get restored, if it can be. In other words: Not every company has good backup practices. Considering that, as noted in the security investigation, UBS had other poor security practices it may not be surprising if they didn't have good backups. Even if a backup has been made it takes time to restore. During this time ...


9

Nothing can prevent physical items being stolen by a sufficiently determined adversary; even the British crown jewels have gone AWOL over the years, and they live in the Tower of London. What mitigates the risk, for me, is encrypting my backups. Most enterprise-grade backup software, including the excellent bacula, allow the encryption of backups. Once ...


8

No. Consumer grade cloud backup is not an effective solution. In fact no single solution will protect your data, you must mix it up a bit. To give you a good answer I would have to know about your habits, usage patterns, and a lot of other details, but here is my best guess based on an average home/small business owner I'm usually working with. So, to ...


7

Yes, it is very easy to retrieve data if you have the tape. The only challenge with older tapes is ensuring you have an appropriate reader. Once you have the reader you can easily work out what operating system and backup application write to the tape. You must treat backups the same way you treat live data. If it is sensitive, use controls such as ...


7

no, you could be MITM'd unless you're using AD and/or IPsec passwords are encrypted the data is in the clear yep, it's a nightmare to keep on top of Windows SMB/CIFS holes. You also have to watch for being brute-forced. Even if you limit it to one account, that account has access to all the data, and privilege escalation on SMB is not unheard of. The ...



Only top voted, non community-wiki answers of a minimum length are eligible