I am trying to find out a way to protect files that will be stored on a drive accessible to the public. Using permissions is not an option in this case, so I am planning to encrypt the files using PGP (or GPG).
It is critical that the files be accessible quickly in an emergency (they are backup files for some important databases), possibly two or three years down the road, but only to one of about five people.
This would be easy if these five people were experienced GPG users, but most people in the team are very casual/occasional GPG users.
My general idea is to create a GPG key for that specific purpose, and distribute it to the team.
Here are my concerns:
- Casual users may simply forget that they even have the key, or forget the pass phrase to their key ring or to the GPG key itself.
- Our workstations get replaced on a fairly regular basis, and users may forget to transfer their GPG key ring (or the GPG key).
In the context of this question, I am not worried about usability issues (such as not remembering how to use gpg) - I'll address that separately with scripting and documentation in a knowledge base.
We will of course have one additional copy of the key on a USB stick in a vault, but I'm looking for additional ways to keep the key secure, yet keep it available quickly in an emergency.