The question is simple, and really interesting at the same time.
How would you keep your data secure in case of a total compromise of your infrastructure? This should NEVER happen, but as we all know, bad things happen, and I'm preparing for the worst.
I have two types of data:
- Log data (access logs from the application itself, security logs etc.)
- MySQL backups
We already have a system in place where the MySQL backup and all logs including is getting transferred periodically to Amazon S3 storage.
This will protect us in case of a total crash (should never happen either - Doomsday prepping!)
But what if a malicious hacker were to compromise the entire system? What would be the best solution? He can easily take out our API key and misuse it to delete data from Amazon S3. We have expire rules in places so versioning is a no-go.
I'm thinking of some kind of write-only service running on an entirely different system? Maybe something like Rollbar.com for logs and an entirely different server which pull down the database periodically, for completely off limits storage?
What's your thoughts on my proposed solutions? Do you have any ideas? Comments? Is this secure enough? Any alternatives?