2

As a company we are performing daily backups onto RDX removable media which is fully encrypted (shows as unformatted drive) and the backup software also encrypts the files during the backup process, both encryptions are 256bit and different passwords. One of two directors stores the RDX removable media at their home in a fireproof safe. The RDX media is switched before going home each day and then transported in the director’s company/personal vehicle.

The problem we are facing is a compliance issue, some of our existing customers and potential new customers have flagged our procedure as inappropriate and I have now been asked by the directors to look at tweaking our existing system or finding an alternative. Here’s what I have been considering as tweaks to our existing stagey…

Audit and chain of custody: We have the resources and skill to create an audit for pickup, transport and delivery and I was also thinking of adding GPS tracking too.

Outsourcing to external company: This would certainly give an audit trail and chain of custody with secure location, but the cost of £480 per month is something we would like to avoid.

Here’s what I’ve been considering as alternates…

NAS backup to a fireproof/waterproof device: I have issues with this as it doesn’t sit well in a business continuity plan as compliance requires an alternative location.

Cloud backup: I want to avoid this and will only go with this if it’s the last option. The problem is that the customers flagging our procedure as inappropriate have been non-specific so some initial feedback regarding our process would be helpful, plus alternatives and tweaking suggestions.

Thank you.

Improve this question
4
  • 3
    You mention compliance, compliance with what? What are your customers' objections? Where do you keep your passwords/encryption keys? Who would be interested in this information? (this is important to assess the risk of a violent attack to steal the data while in transport or in storage). Yes, your answer is long and detailed, but you really didn't provide the important details)
    – Adi
    Commented May 4, 2013 at 13:34
  • How much data? What is minimum acceptable recovery time? What is you upstream bandwidth?
    – Brian Adkins
    Commented May 4, 2013 at 13:56
  • RDX media? Good grief... Sincerely hope your safe is also blast-proof!
    – Deer Hunter
    Commented May 4, 2013 at 15:25
  • @DeerHunter Not that RDX, Imation's RDX.
    – Dan D.
    Commented May 5, 2013 at 1:55

1 Answer 1

Reset to default
3

You can probably negotiate with your bank to allow you to use night deposit bags for drive storage. Pad it so the drive can cope with shocks from lots of coins. You can arrange so they won't open your bags. During the day, somebody can move the backup disk in a safety deposit box.

That said, with the data encrypted, your current solution isn't necessarily a bad one. You have reasonable controls to prevent loss of the data by means of encryption.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .