What security features and qualifications should we look for in an online backup provider for an Internet-exposed web server storing sensitive data?

  1. In the backups themselves - encryption type, transport method, data center qualifications?

  2. In the client software that runs on our server- What do we look for to determine if the client software will create attack vulnerabilities in the server. I'm specifically thinking about a case where an attacker pretends to be the backup provider's service and "restores" a malicious file onto our system or obtains a copy of something sensitive. What questions should we ask to mitigate this possibility? ie. should the client authenticate the provider's server?

  3. Is it bad practice to use a backup service that can (easily) restore files back to your server? ie. where you can select files on a web based control panel and it restores those files "on demand"?

In our case, it's a production web server that runs an e-commerce site and collects credit card information. We need to 1.) Maintain PCI compliance and 2.) prevent down time and bad publicity.

  • Your downtime would be better publicity then the lost of the credit card information. I suggest using a system of full ENCRYPTED backups that you perform yourself. Implement a plan that allows for backup equipment to be operational within X hours after a confirmation of hardware failing.
    – Ramhound
    Mar 14, 2012 at 18:25

1 Answer 1


I'd say that the PCI compliance aspect is going to complicate things more than a little bit and that you should really speak to your QSA about requirements. Whilst I'm not a QSA it would seem to me that if you backup card data then that backup service would effectively become part of your cardholder data environment.

Apart from that one thing I always look at for online backup facilities is whether your data is encrypted when stored with them.

Unfortunately it's not as simple as it either being encrypted or not, as all providers will say that it is. some providers use a common key for encryption which means that they can get access to the data without your password, which means that if their security is compromised it could lead to your data being compromised

So one important thing to consider is whether your data is encrypted in such a way that compromise of their systems won't compromise your data.

A service I've used for backups is SpiderOak and their model is to handle encryption client-side so that the encryption key shouldn't be available on their server. The downside here is that if you forget the password there's no way for them to retrieve the data.

The question about the service being able to restore data to your servers would seem to be a security concern as to achieve that it would seem that the provider would need persistent write access to your server.

  • Encrypting the data yourself before you upload to these services is always a good idea.
    – Ramhound
    Mar 14, 2012 at 18:25
  • +1. I'll look into SpiderOak. Are some encryption methods preferable to others ie Blowfish vs AES? If we decided to backup everything except card numbers would that make things easier? We would still have to worry about direct attacks against the production server through the backup software's client program and I'm not sure how to determine which backup clients are secure in that regard and which ones aren't.
    – Nick
    Mar 15, 2012 at 13:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .