What security features and qualifications should we look for in an online backup provider?

Question

What security features and qualifications should we look for in an online backup provider for an Internet-exposed web server storing sensitive data?

1. In the backups themselves - encryption type, transport method, data center qualifications?

2. In the client software that runs on our server- What do we look for to determine if the client software will create attack vulnerabilities in the server. I'm specifically thinking about a case where an attacker pretends to be the backup provider's service and "restores" a malicious file onto our system or obtains a copy of something sensitive. What questions should we ask to mitigate this possibility? ie. should the client authenticate the provider's server?

3. Is it bad practice to use a backup service that can (easily) restore files back to your server? ie. where you can select files on a web based control panel and it restores those files "on demand"?

In our case, it's a production web server that runs an e-commerce site and collects credit card information. We need to 1.) Maintain PCI compliance and 2.) prevent down time and bad publicity.

Answer 1

I'd say that the PCI compliance aspect is going to complicate things more than a little bit and that you should really speak to your QSA about requirements. Whilst I'm not a QSA it would seem to me that if you backup card data then that backup service would effectively become part of your cardholder data environment.

Apart from that one thing I always look at for online backup facilities is whether your data is encrypted when stored with them.

Unfortunately it's not as simple as it either being encrypted or not, as all providers will say that it is. some providers use a common key for encryption which means that they can get access to the data without your password, which means that if their security is compromised it could lead to your data being compromised

So one important thing to consider is whether your data is encrypted in such a way that compromise of their systems won't compromise your data.

A service I've used for backups is SpiderOak and their model is to handle encryption client-side so that the encryption key shouldn't be available on their server. The downside here is that if you forget the password there's no way for them to retrieve the data.

The question about the service being able to restore data to your servers would seem to be a security concern as to achieve that it would seem that the provider would need persistent write access to your server.