Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

There are (pdf) files placed under unix with 700 permission. The files contain sensitive data. Would it be a good idea to also encrypt these files? Would it make them any more secure?

share|improve this question

migrated from stackoverflow.com Jan 17 '10 at 6:05

This question came from our site for professional and enthusiast programmers.

    
Where are the files? Are they on a server in your office? A server in a data center? Your desktop at home? Your laptop? The answer may depend on that. –  user76967 Apr 20 '11 at 11:47
add comment

6 Answers

I routinely encrypt files that I don't want others to touch. Note that a lot of encryption relies mostly on the selection of a good password. I also distrust most built-in encryption systems and just choose to use PGP (well, GnuPG actually.)

PGP is reliable, well-tested, and understood. Of course I have to decrypt the files while working or viewing them, but generally, for my uses, this is not an issue.

I also use an encrypted filesystem on my flash drives and the home directories and swap on my NetBSD laptops. After all, I never know when I'll drop one on accident or have one stolen. It's just easier to not worry about it and encrypt the whole drive rather than file by file. I still use PGP for the really private things, as it protects one step further from someone typing on my keyboard.

But then again, I'm paranoid.

share|improve this answer
2  
Just because you're paranoid, it doesn't they're not out to get you, you know. Join the club. –  pavium Jan 17 '10 at 11:11
    
paranoid isn't thinking they are out to get you; they are. paranoid is thinking they are co-ordinated about it... whens this club meet? –  Antitribu Jan 18 '10 at 9:42
1  
It meets at: ---BEGIN PGP ENCRYPTED MESSAGE--- kjsdAsdJD3kj23hasd== ---END PGP ENCRYPTED MESSAGE--- –  Michael Graff Jan 18 '10 at 18:44
add comment

If you trust both the physical security of the computer (which includes trusting the honesty of anyone who has physical access that computer), and the security of the operating system (including its configuration), then encrypting the files is unnecessary.

But you may not want to trust the physical security of the computer after it's been hauled away by serious people, in which case you ought to put some effort into doing encryption. The simplest way to have it is to do it at the lowest level - i.e. whole-disk encryption. That way you only have to worry about passwords when rebooting, and there are ways around that, too.

share|improve this answer
    
Your first sentence implies you're not running anything that is on the network, is Windows, or has a keyboard. Just saying. –  Michael Graff Jan 18 '10 at 18:41
    
@Michael Graff: If you don't trust the security of the OS or the hardware, you're hosed anyway. I'm sorry, what was your point again? –  Teddy Jan 19 '10 at 9:59
    
OSs have bugs. Administrators make mistakes. People run untrusted things all the time. Encrypting private data keeps it private. –  Michael Graff Jan 19 '10 at 10:00
    
@Michael Graff: If the OS has a bug, or if an admin makes a mistake, or if you run an untrusted program, you can no longer trust the security of your encrypted files - some sniffer may have been installed to log your password for the next time you decrypt the files. If you can't trust the OS or hardware, you have no place to stand. –  Teddy Jan 20 '10 at 5:11
    
I think we'll have to agree to disagree on this. I don't trust the OS to never make a mistake, I don't trust a laptop not to be stolen, and I don't trust that what may be secure today is forever secure. But then again, I work in security, so perhaps I'm just looking at things differently. –  Michael Graff Jan 20 '10 at 14:22
show 3 more comments

You need to first determine who your foes are.

If you're a lowly user, and you don't want root to be able to read your files by accident while he's tracking down some problem you ask him to look into, then yes, encryption of files is a good solution.

If you're using files on a laptop which can be carried around the city, and potentially any thief can take your laptop and become root, then yes, encryption is a good solution. In that case though, encrypting the whole drive or at least your home directory would be better.

If you're working in some relatively high-security office setup where you want two-factor authentication (password + a key on a keycard/usb drive/etc.) because you don't trust co-workers not to gain access with your password by watching you type or something, then yes, file encryption would make sense.

In most other cases, encrypting files isn't helpful. File permissions/security and web permissions/security are more appopriate focuses for your attention.

share|improve this answer
add comment

Well encryption won't make them any less secure. It will certainly help protect against physical theft, provided you don't document any passwords, passphrases, keys etc on the same system.

share|improve this answer
add comment

Check your organization's Sensitive Data Handling policy, and the absence of that talk the group most responsible for data security. You may be required to encrypt the data (or much stronger measures) depending on exactly what it is.

My general rule of thumb is to recommend encryption whenever in doubt wherever feasible. The trick, of course, is choosing an encryption method that protects against the threat you are attempting to mitigate.

share|improve this answer
add comment

Its only safe to do it . But if its a Unix box and other dont have access to it then it should be fine . But its always better to encrypt critical datas .

share|improve this answer
    
It's not "always better". No security is good unless it's done right. They talk about a "false sense of security" for a reason: thinking your data is safe when it's not is a good deal more dangerous than knowing that it's not safe. –  Lee B Apr 28 '10 at 19:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.