Security concerns on online backup

Question

Can there be any security with online (cloud) backup? There are solutions that claim to be secure because they encrypt on client side. But there is a client on your server that has access to all your data. And this client gets read commands from the backup company. So there is absolutely no inherent security. The backup company has allways full read access on all your data. Do you agree that there is no security at all with online backups? Is there any other IT service where you give full read access to an external company?

Answer 1

It seems you're thinking about online backup services, such as Crashplan, Mozy, Backblaze, etc. There is nothing inherent in cloud backup that requires you to use someone else's software. You can create your own backup archive, encrypt it locally and upload it to any cloud storage such as S3 or Rackspace Cloud Files. Without the decryption key there's nothing anyone can do with that data. This is just as secure as storing your encrypted tapes in a tapevault-service like Iron Mountain.

If you use an online backup service to perform the backup then you're right. You need to trust the provided software, and trust the companies security methods. There's no guarantee that there isn't a backdoor of some kind. Malicious intent would ruin their business if found out, but of course there's also simple incompetence that can put your data at risk. Ubuntu One has an open-source client that you can review and compile yourself. If you trust the local encryption there is really no need to trust the remote servers.

As always, it's a choice between the convenience of already written and proven software and the amount of trust you're willing to place in someone else's business model.

Answer 2

Not all remote backup software receives commands from the backup company. See tarsnap. The client initiates the backup. The client is open source, and the design methodology is explained by its author.

Answer 3

I encrypt my data locally with encfs and sync the encrypted dir with the cloud backup. I'm likely sure the backup company has no chance to access my data except cracking the encryption.

It is also possible to mount a remote dir of the cloud locally, e. g., with webDAV or sshfs---whatever the cloud company offers---and use that as encfs' encrypted dir. This way all files in the decrypted dir will be encrypted and stored in the cloud on-the-fly. I'm pretty sure this is secure, because the files will first go to encfs for encryption and then go to the remote mount for storing so they will only be transferred encrypted.

In my case this direct mounting didn't work out, because I regularly do an rsync of my work files into the decrypted dir, but somewhere between encfs and the remote mount some timestamps get corrupted, so rsync cannot detect file changes and uploads all files on every call.

Answer 4

If you can't/don't trust the backup client then no, it's not secure, and you'll have to write your own client. A secure system can be made however, where the client encrypts backups with a public key and only ever uploads the encrypted backups. The backups can only be decrypted using the private key which the backup client doesn't need and so can be stored securely elsewhere.

Answer 5

Our company with almost 20'000 employees do the backup in-house. But particular things we do back up online on a cloud service. As a company you make contracts for online backup storage and there is always described that the company does not read your content, just store it.

And yes youre concerns about privacy and data protection is useful. But most of the clients encrypt the content before they send it to the online backup. And for sure all companies could read their customers data. But for a company with a great reputation this would be a big scandal.
So it should be safe enough to store backups in an online backup solution. If you are big enough and have enough ressources you can do it yourself.

BTW: Take a look at Ubuntu One Cloud. The source code is open and so you can look what the client does and how the data will be encrypted.

Answer 6

Obviously YES. Because you have to take the word of the company providing the service.
They don't provide you with any way to see what is going on at the server end and you may have no access to the source code for the client side.

With those factors, how could there not be any security concerns?

Answer 7

Another possibility: Hire a cloud unmanaged server and set up Owncloud. The data will be stored in your remote server and there you could encrypt the content with truecrypt or another software. Owncloud is built to be your personal cloud.