Some experts opine that long-term storage discs should not be encrypted because 30 years from now, there is a very high probability that the password will be lost. I think this is a very valid point. However, I think leaving unencrypted long-term data in a safe is also dangerous. Also, the safe would have to be pretty big if you have a lot of data to store. Someone can silently come into my business's archive area and secretly steal data, no?

What do experts suggest is a good balance or alternative?

  • You describe the typical trade-off between security and easy of use. But I think nobody can decide for you if some kind of protection is necessary and how good it should be, because this depends on the sensitivity of the data and your actual risks and threats. Note that you can also encrypt all data but then store only the encryption key in the safe. In this case the safe would need to be much smaller than if storing also the data in the safe. But whatever you do, every solution will be some kind of trade-off and need to decide what the right balance for your specific use case is. – Steffen Ullrich Oct 17 at 22:19
  • Steffen, Very intelligent solution. Never thought that. You actually gave me a great idea for the PERFECT type of protection. I'll give you a percentage if I ever execute it. $100 MM if I ever get around doing it? – QuietInMontana 2 days ago

I think there are several points to take into account:

  • Format: you want the issue contents to be readable, this involves the choice archiving, compression, and encyption algorithms, using formats that are likely to be usable in the future.
  • Encryption keys: similar to the above
  • Use case: why/when you expect to use the stored data

I think we should focus on this last point.

If the data being stored was public (for example, the kind of content that might want to preserve a library or museum) there would be no point in encrypting it, the safe would be just to protect the medium (such as from a fire), whereas if there is some kind of confidential data both the safe and the encryption would be useful to prevent it.

Assuming these are indeed confidential (say, your business backups), we may want to focus on which cases you may want to access the information. Is it for some legal reasons, in order to fetch that deleted data two years after or to recover all your data after a catastrophic failure of your systems (e.g. a ransomware infecting the whole company)?

I think the company should have some kind of secure storage -such as a password manager- for the multiple keys it will need to handle (computer systems, bank accounts, domain registrars...). Adding an entry for the backup encryption would be trivial.

However, if we expect to recover from a complete IT failure using these backups, the encryption key should also be available somewhere else (and the safe pin, while we are at it). It is unlikely that in such case you needed the backups from 30 years ago, though.

In fact, it is quite unlikely that you suddenly need a file 30 years later. The only case I can think of would be for some historic digging.

As for the problem at hand, I think it may be a good idea to encrypt it, just because it is simple to do that on creation. If you want then not to be encrypted, you can simply store the key along the media in the safe. If you want to protect it better (say, you got a second safe at a different site, or at the bank), you move the documents holding the keys there. I would not advocate for only having the keys there. I would still keep them at the password manager, and perhaps on every backup (or every year supposing you don't cycle the keys for each backup), print a whole list of keys from there to store (thus you have a recently printed copy of the old encryption keys, thus thwarting that the encryption key was unreadable due to age).

A different approach might be to use a weak password on purpose which is so easy and memorable enough so that you are sure it won't be forgotten on 30 years, and even if it was, that you would be able to reach someone that knew it and still remembered it. It's still a gamble to bet that it would be remembered, although you might want to combine it with other approaches as a last-layer (assuming that a relatively known key would still protect them appropriately for your needs e.g. from the cleaning crew).

| improve this answer | |
  • This was an excellent answer. Thank you. It must have taken you some time to think of so many possible permutations and then write it out. Thank you. Thank you. I'm sorry but I couldn't understand the penultimate paragraph. Can you rewrite it? There are little too many pronouns so I don't know sometimes what you are referring to. I reread it 3 times and I still didn't understand some sentences. Thanks. – QuietInMontana 2 days ago
  • By the way, I've never lived long enough to have 30 year old data but I have 20 year old data that I do need and want encrypted. 20 years go fast and I have business trade secrets when I started and I want to remember them but I don't want people to know them either. I can now understand you would want to be able to save data that lasts 100 years easily! I would want to pass on my business secrets to teach my daughter and son. – QuietInMontana 2 days ago
  • I even have personal pictures of my little kids that I'm sure that they don't want others to see. I have one video of my little son singing and I promised him that I would erase it. (I know I am naughty but I didn't have the heart to erase it.) I think he'll forgive me for saving it (hopefully) but I think he'll get very mad at me if other people saw it except perhaps for his future wife? – QuietInMontana 2 days ago
  • This comment limit is getting really stupid. – QuietInMontana 2 days ago

The biggest threat to your data is likely to be media, format, and software obsolescence. Look back 30 years, and think of the storage of the era. The medium is mostly unavailable today - magnetic tapes, floppy discs, JAZ/ZIP drives, and ST-504 and SCSI hard disks. The data formats might have been dBase, Lotus, Excel, or other proprietary binary formats. And how much of that data would be accessible today? It’s not as if you can buy a copy of dBase 2020 today. Planning and preparing the archive to be accessible in the future is important.

Our team maintains an archive of sensitive legacy data. The data is encrypted and converted to a simple database format prior to storage, with a full source and binary copy of the Java database program kept with the database; a backup in plain CSV format is also included on the drive. We have multiple copies of the data, written on encrypted thumb drives (the kind with built in PIN pads.) The drives were purchased from a variety of manufacturers, with the intent of avoiding some manufacturing defect that might be common to a single source. Printed paper copies of the recovery instructions were written up and one travels with each drive. Copies are kept sealed in tamper-evident bags in multiple safes. The PINs to the drives were randomly generated by a separate person, and are stored in different safes. And the encryption keys are stored in a separate Hardware Security Module.

Most importantly, we have included annual recovery of sample data from each copy in our archive’s disaster recovery plan. Part of the plan includes a test retrieval of a secret from each drive every year, to make sure the data remains recoverable. If any errors are detected, we will replace all the drives.

You can store the data for as long as you need, as long as you are willing to pay to do it properly.

EDIT: To answer some questions from the comments:

  • We are preserving the data for legal reasons, not ease of access. The archive exists only for a future unforeseen situation; long recovery times are unimportant, and we have no need to build an automated recovery process. If we planned on accessing the archive on a regular basis, we would have kept it online.
  • Our archived data is small and finite, and we have less than 10 million rows, so converting them to Base64 encoded CSV records was easy for us.
  • The data format is of much lesser importance than the ease of archiving.
  • Each record in our archive includes an unencrypted date stamp so we can dispose of the data according to our records retention policy.
  • The price of a few secure thumb drives was a trivial fraction of the cost, and did not factor in to the solution.
  • The PINs were generated and entered by our Security Officer; this prevents anyone (including me) from checking out a thumb drive from a safe and making a copy of the archive without his knowledge.
  • This is an internal archive; we are not performing this as a service for external parties. Our need for trust runs upward, not outward.
| improve this answer | |
  • John, great answer! Thanks. It gives me a lot to think of. Are you in the industry? Just thinking about some of the things you wrote. Some questions immediately pop up in my mind. 1. Wouldn't converting it into simple database format take a lot of time? Wouldn't preserving the format be important? Even keeping 3 copies of each type of hardware that are sealed and rarely used, might be cheaper, no? – QuietInMontana yesterday
  • 2. What does PINs randomly generated by a separate person really demonstrate? You can even say it's a 3rd party company who generated it and it's still not going to be 100% believable. Might be better if it was like a client picked a person in a crowd-type magic trick. 3. If you are a security company, how do you assure the client that you yourself are not going to steal the password? 4. Is there a common data format 30 years ago that is still around today? 5. What is the cost of your services? Are you the owner? – QuietInMontana yesterday

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.