Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Can there be any security with online (cloud) backup? There are solutions that claim to be secure because they encrypt on client side. But there is a client on your server that has access to all your data. And this client gets read commands from the backup company. So there is absolutely no inherent security. The backup company has allways full read access on all your data. Do you agree that there is no security at all with online backups? Is there any other IT service where you give full read access to an external company?

share|improve this question

7 Answers 7

It seems you're thinking about online backup services, such as Crashplan, Mozy, Backblaze, etc. There is nothing inherent in cloud backup that requires you to use someone else's software. You can create your own backup archive, encrypt it locally and upload it to any cloud storage such as S3 or Rackspace Cloud Files. Without the decryption key there's nothing anyone can do with that data. This is just as secure as storing your encrypted tapes in a tapevault-service like Iron Mountain.

If you use an online backup service to perform the backup then you're right. You need to trust the provided software, and trust the companies security methods. There's no guarantee that there isn't a backdoor of some kind. Malicious intent would ruin their business if found out, but of course there's also simple incompetence that can put your data at risk. Ubuntu One has an open-source client that you can review and compile yourself. If you trust the local encryption there is really no need to trust the remote servers.

As always, it's a choice between the convenience of already written and proven software and the amount of trust you're willing to place in someone else's business model.

share|improve this answer

Not all remote backup software receives commands from the backup company. See tarsnap. The client initiates the backup. The client is open source, and the design methodology is explained by its author.

share|improve this answer

I encrypt my data locally with encfs and sync the encrypted dir with the cloud backup. I'm likely sure the backup company has no chance to access my data except cracking the encryption.

It is also possible to mount a remote dir of the cloud locally, e. g., with webDAV or sshfs---whatever the cloud company offers---and use that as encfs' encrypted dir. This way all files in the decrypted dir will be encrypted and stored in the cloud on-the-fly. I'm pretty sure this is secure, because the files will first go to encfs for encryption and then go to the remote mount for storing so they will only be transferred encrypted.

In my case this direct mounting didn't work out, because I regularly do an rsync of my work files into the decrypted dir, but somewhere between encfs and the remote mount some timestamps get corrupted, so rsync cannot detect file changes and uploads all files on every call.

share|improve this answer

If you can't/don't trust the backup client then no, it's not secure, and you'll have to write your own client. A secure system can be made however, where the client encrypts backups with a public key and only ever uploads the encrypted backups. The backups can only be decrypted using the private key which the backup client doesn't need and so can be stored securely elsewhere.

share|improve this answer

Our company with almost 20'000 employees do the backup in-house. But particular things we do back up online on a cloud service. As a company you make contracts for online backup storage and there is always described that the company does not read your content, just store it.

And yes youre concerns about privacy and data protection is useful. But most of the clients encrypt the content before they send it to the online backup. And for sure all companies could read their customers data. But for a company with a great reputation this would be a big scandal.
So it should be safe enough to store backups in an online backup solution. If you are big enough and have enough ressources you can do it yourself.

BTW: Take a look at Ubuntu One Cloud. The source code is open and so you can look what the client does and how the data will be encrypted.

share|improve this answer

Obviously YES. Because you have to take the word of the company providing the service.
They don't provide you with any way to see what is going on at the server end and you may have no access to the source code for the client side.

With those factors, how could there not be any security concerns?

share|improve this answer

Another possibility: Hire a cloud unmanaged server and set up Owncloud. The data will be stored in your remote server and there you could encrypt the content with truecrypt or another software. Owncloud is built to be your personal cloud.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.