Currently we don't have a server in a small organization with a very limited budget. We do backup by syncing files between workstations with Windows 10 OS. I'd like to encrypt these files because they contain sensitive data and I don't want the members of the organization to access each other's data or to send the data unencrypted on the local network. I thought of winrar encryption, but I am not sure if it is good enough. What kind of encryption do you recommend?
6
-
1Rather than not being good enough, what happens if the password is forgotten, or if you do not properly secure the password? It sounds like you want to rar and encrypt the data before sending it, is that handled manually by IT or by some automated process? If it's automated you'll need to send the key/password to that device, at which point it may be possible to capture it.– userCommented Nov 9, 2021 at 22:54
-
@user It is manual encryption by the owner of the computer before sending it. I think we will store the passwords in a tresor.– inf3rnoCommented Nov 9, 2021 at 23:21
-
1If you have limited budget, you should at least have cloud-based backup. If (when) a ransomware encrypts all your files, you will not have money to pay the ransom.– ThoriumBRCommented Nov 10, 2021 at 0:42
-
@ThoriumBR We cannot pay ransom and cannot use cloud either. But good point, this solution does not protect against ransomwares.– inf3rnoCommented Nov 10, 2021 at 0:47
-
So prepare to lose all your data. On-site backup is good against accidental file deletion, but cannot protect you in case of a disaster. Even worse backing up on a workstation.– ThoriumBRCommented Nov 10, 2021 at 0:49
|
Show 1 more comment
1 Answer
I see two severe issues with your backup solution: in-place backups and WinRAR as backup tool.
The first issue is that in-place backups are not reliable backups. They can protect your data in case of accidental deletion, or a failed hard-disk, but will not protect you in case of a real disaster, like a ransomware. If a ransomware attacks your computers, all of them will be encrypted and so will your backups.
If you don't have money for cloud-based backups, and you have limited resources, you can buy an used computer, a large hard disk, and install a dedicated backup server. It does not have to be a new computer, it can even be an older Raspberry Pi, or an old Pentium 3. It will not process a lot of data, and the size of the hard disk is more important than RAM or processor speed.
It would be good if it ran another OS (Linux would be a good choice) so any malware compromising the Windows workstations would not automatically infect the backup server too. There are dozens of backup applications on Linux, and a quick search online can land you on a page comparing them.
And WinRAR is not a good tool for encrypted backups for a couple reasons:
Wrong tool for the job.
Winrar is a compressing utility, not a backup utility. It can be used as a backup tool, like a knife can be used as a screwdriver.
Lack of key management
One of the components of the CIA triad is Availability. If you lose the password, all your files are lost forever. Unless you use a very weak password that makes moot the entire point of encrypting anything.
Lack of automation
Manual backups don't work. You can start the backups manually for a while, but you will forget about them in a while. WinRAR can be automated, but the effort needed means new directories can end up not covered.
Lack of resources
This is partially covered by point 1: WinRAR cannot do incremental backups, cannot prune stale files, cannot easily compare versions. It's useful for backing up a computer before a reinstall, but not for daily backups.
Have a better tool. Again, search online for a proper backup tool and you will find good and free solutions.
answered Nov 10, 2021 at 1:03
