What security features and qualifications should we look for in an online backup provider for an Internet-exposed web server storing sensitive data?
In the backups themselves - encryption type, transport method, data center qualifications?
In the client software that runs on our server- What do we look for to determine if the client software will create attack vulnerabilities in the server. I'm specifically thinking about a case where an attacker pretends to be the backup provider's service and "restores" a malicious file onto our system or obtains a copy of something sensitive. What questions should we ask to mitigate this possibility? ie. should the client authenticate the provider's server?
Is it bad practice to use a backup service that can (easily) restore files back to your server? ie. where you can select files on a web based control panel and it restores those files "on demand"?
In our case, it's a production web server that runs an e-commerce site and collects credit card information. We need to 1.) Maintain PCI compliance and 2.) prevent down time and bad publicity.