In addition to regular onsite backups (kept in a fire resistant safe), we also send tapes offsite once a month, encrypted with AES. So if our site is one day vaporised by an alien heat ray, we should at least have one recent backup to recover from.
Except that the 128-bit encryption key is only stored onsite. So in the case of a true disaster, we would actually be left with one encrypted backup, and no way to decrypt it.
Question: What is the best policy for storing the encryption key offsite?
Whatever method we choose needs to pass a security audit, so "keep a copy at home" is not adequate, and "keep it with the offsite tapes" obviously defeats the purpose of encrypting them in the first place! A couple of options we are considering include:
- A safety deposit box in a bank
- Stored in the cloud or on a geographically separate network in password-protected form (e.g. using software like Keepass or Password Safe)
Of course, the second option poses another question: how do we keep that password safe.