There are (pdf) files placed under unix with 700 permission. The files contain sensitive data. Would it be a good idea to also encrypt these files? Would it make them any more secure?
Tell me more
×
Server Fault is a question and answer site for
professional system and network administrators. It's 100% free, no registration required.
|
|
||||
|
migrated from stackoverflow.com Jan 17 '10 at 6:05
|
You need to first determine who your foes are. If you're a lowly user, and you don't want root to be able to read your files by accident while he's tracking down some problem you ask him to look into, then yes, encryption of files is a good solution. If you're using files on a laptop which can be carried around the city, and potentially any thief can take your laptop and become root, then yes, encryption is a good solution. In that case though, encrypting the whole drive or at least your home directory would be better. If you're working in some relatively high-security office setup where you want two-factor authentication (password + a key on a keycard/usb drive/etc.) because you don't trust co-workers not to gain access with your password by watching you type or something, then yes, file encryption would make sense. In most other cases, encrypting files isn't helpful. File permissions/security and web permissions/security are more appopriate focuses for your attention. |
|||
|
|
|
If you trust both the physical security of the computer (which includes trusting the honesty of anyone who has physical access that computer), and the security of the operating system (including its configuration), then encrypting the files is unnecessary. But you may not want to trust the physical security of the computer after it's been hauled away by serious people, in which case you ought to put some effort into doing encryption. The simplest way to have it is to do it at the lowest level - i.e. whole-disk encryption. That way you only have to worry about passwords when rebooting, and there are ways around that, too. |
|||||||||||
|
|
I routinely encrypt files that I don't want others to touch. Note that a lot of encryption relies mostly on the selection of a good password. I also distrust most built-in encryption systems and just choose to use PGP (well, GnuPG actually.) PGP is reliable, well-tested, and understood. Of course I have to decrypt the files while working or viewing them, but generally, for my uses, this is not an issue. I also use an encrypted filesystem on my flash drives and the home directories and swap on my NetBSD laptops. After all, I never know when I'll drop one on accident or have one stolen. It's just easier to not worry about it and encrypt the whole drive rather than file by file. I still use PGP for the really private things, as it protects one step further from someone typing on my keyboard. But then again, I'm paranoid. |
|||||||||
|
|
Well encryption won't make them any less secure. It will certainly help protect against physical theft, provided you don't document any passwords, passphrases, keys etc on the same system. |
|||
|
|
|
Check your organization's Sensitive Data Handling policy, and the absence of that talk the group most responsible for data security. You may be required to encrypt the data (or much stronger measures) depending on exactly what it is. My general rule of thumb is to recommend encryption whenever in doubt wherever feasible. The trick, of course, is choosing an encryption method that protects against the threat you are attempting to mitigate. |
|||
|
|
|
Its only safe to do it . But if its a Unix box and other dont have access to it then it should be fine . But its always better to encrypt critical datas . |
|||
|
