0

It's relatively straight-forward to create an encrypted storage volume (e.g. Like so: https://www.digitalocean.com/community/tutorials/how-to-create-an-encrypted-file-system-on-a-digitalocean-block-storage-volume .) However, since the filesystem is decrypted on boot, and the server's always on, won't the data be sitting on our VPS in plain-text anyway?

Is there any value, at all, to using full-disk encryption on an always-on VPS?

--edit---

my goal is to make it financially non-viable for the host to access my data and source code. Is disk encryption beneficial in respect of this?

4

The solution is certainly not pointless.

But the risk scenario you’re protecting against with full disk encryption is not somebody compromising your running instance, you’re adding protection against threats at a different level such as for example the theft of the physical disks that are used for storing the data in your VM. (And other threat scenarios.)


In response to the OP's edit:

If you have no reason to trust your cloud provider you shouldn't be using them. Because whoever is in control of the hardware can generally defeat any protections you can mount from within a VPS.
Adding protection such full disk encryption does already ensure that it won't be trivial to get to all your data though. Your data confidentiality will be protected from the many of the most trivial "attacks", operator errors and misconfigurations.

But technology can't provide absolute protection there.

That means that you need to trust the provider.

In business you don't trusts blindly though. You do your own due diligence selecting a trustworthy provider and then you get your legal team to set up agreements and contracts, with penalties and other ways to enforce compliance.

11
  • I should have been more clear - my goal is to make it financially non-viable for the host to access my data and source code. Is disk encryption beneficial in respect of this? – Glenn Apr 22 at 12:40
  • 1
    @Glenn No, not really. It's trivial for the host to grab whatever you have in memory, including key material. Change to a host that you trust. – vidarlo Apr 22 at 16:04
  • Indeed @vidarlo you need to be able to trust the provider. – Bob Apr 22 at 16:12
  • Unfortunately the trustworthy-er hosts, like DO have awful privacy policies. The security-focused VPS providers (I'm trying one at the moment) cost crazy e.g. orange Iceland) or have horrendous sysadmins, such as 1948 Iceland - I'm trying them out at the moment and they frequently respond to (sensible - may I add) around 24-hours after they are sent. So I would like to shout from the hilltops BOYCOTT 1948 HOSTING, ICELAND! They wasted my entire day, yesterday as I could not partition the disk due to their server config, and they ignored my email... – Glenn Apr 22 at 16:17
  • Today they informed me that it is possible to use their web console to manually install a debian iso. Awesome. Trouble is - the web console doesn't work. Again they're ignoring my emails - which is the reason I'm so angry with them - time is money. Anyway, this isn't VPSReviews.com, so, sorry! – Glenn Apr 22 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.