1

Assume that a server has Full Disk Encryption enabled - LUKS for Linux and BitLocker for Windows. This FDE requires a passphrase on boot to allow the disk to be unlocked and facilitate the boot process.

Many pieces of Backup and Recovery software offer the option to encrypt your backup. Presumably this prevents a attackers ability to mount your backups a la Phineas Fisher should they fall into the wrong hand or you have an actor in your network by requiring a passphrase to decrypt the password.

Assuming your encryption passphrases for your FDE is different from other passwords on your network to eliminate password replay attacks, does encrypting your backup in addition to using FDE offer any additional protection or is it simply overkill?

EDIT: My question is in reference to strictly technical security, and procedural issues / people issues should not be taken into consideration.

Improve this question
5
  • depends on your key management, I suppose and who has access and who is authorized to view - media management vs data management
    – schroeder ♦
    Commented May 9, 2017 at 15:16
  • @schroeder Interesting. I had not taken the human element into account. I will revise question to clarify that I meant from a strictly technical perspective.
    – DKNUCKLES
    Commented May 9, 2017 at 15:21
  • I've worked in places where the media is handled by one team, but they have no authorization to view the data, but they hold the FDE keys. In this case, the data needs to be encrypted, too.
    – schroeder ♦
    Commented May 9, 2017 at 15:24
  • Are you backing up to new media? You know that encryption does not survive being copied, right? And if you are backing up to the same media where it resides, then there is little point?
    – schroeder ♦
    Commented May 9, 2017 at 15:25
  • @schroeder you mean to say that FDE does not survive the backup process at a VM level? I've backed up disks with FDE and was prompted for decryption key when restored.
    – DKNUCKLES
    Commented May 9, 2017 at 15:28

1 Answer 1

Reset to default
3

First off, it depends on whether you are backing up a bit-level image of the encrypted disk/filesystem or backing up a mounted (unencrypted) filesystem that happens to exist on an otherwise encrypted disk.

If your backup software is accessing the unencrypted files directly then your backup will be unencrypted. In this case, you would want to enable encryption in your backup software.

Per the issue of double-encryption, this might be considered a defense-in-depth strategy in case something goes wrong with the primary encryption mechanism. Additionally, you could potentially be adding a second layer of key management controls here in addition to the second layer of encryption. Deciding whether or not this is overkill requires a measurement of the impact of losing the data vs the additional cost of double-encryption. Unless there is a time-constraint problem or technical challenge which makes this excessively hard to do it will most likely be worth the cost and not really considered overkill.

Keep in mind that the defense in depth strategy also protects you from some system administration mistakes. For example, if you do this across all systems in your organization and one is setup without disk encryption the backup encryption will still be in place as a safety net.

Improve this answer
1
  • The question of "does your backup tool operate on the physical hard disk or on the logical volumes mounted by the OS?" is really the critical thing here (as highlighted in your bolded "First off"). Copying from a mounted volume will copy decrypted data; only copying directly from the hard disk itself (or the low-level block device representing it in the OS) will copy the encrypted bits.
    – CBHacking
    Commented May 9, 2017 at 19:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .