Secure Backup: Protecting Your Data
This sample chapter is excerpted from White-Hat Security Arsenal: Tackling the Threats by Avi Rubin.
This chapter is from the book
This chapter is from the book
This chapter is from the book
Problem Statement
Alice considers her data very important. She has been around long enough to experience the painful loss of files due to arbitrary failures of software and hardware. The data on Alice's machine is of a very sensitive nature. She is very good at physically securing her machine and protecting her data while it is in her possession, but how does she back up her data in such a way that the backups are reliable and also secure?
Threat model
The adversary in this scenario is a user who manages to get read access to Alice's backup tapes. It should be impossible for him to learn anything about the data that is stored there. In addition, it should be impossible for an adversary to destroy the keys that are used to protect the backup tapes.
6.1 Secure Backups
When I give talks about computer security, viruses, worms, Trojan horses, and other threats, I'm often asked what the state of the art in defense mechanisms is. My reply is always "back up, back up, back up." If you have never lost any data due to some kind of failure that wasn't your fault, you have probably not been using computers for very long.
If you ask me what the easiest way to steal information from a highly secure site is, I will probably not suggest trying to exploit a misconfiguration in the firewall and subverting the perimeter protection to get an account inside and then using that account to break into a protected database. A much easier way is to bribe the truck driver, who transfers the backup tapes from the building to a physically secure site, to look away for a couple of hours while you copy the tapes. This attack will only cost you a few hundred dollars; you may even be able to pull it off for a six-pack of beer.
Backup is one of the most overlooked processes when it comes to site security. However, backup is crucial. Backup is important for recovering from loss due to accidental or malicious failure. You would be hard-pressed to find a person or organization that hasn't had to restore from a backup at some point. When faced with data loss or corruption, the backup archive is one of the most appreciated and loved objects in the entire universe.
What is interesting is that even though backup tapes, by definition, contain data that is just as sensitive as the data being backed up, they rarely receive the same protection as the original data itself. Why is that? Well, the purpose of backup is to recover after some kind of a problem. So, if encrypted data is backed up in its encrypted form, then what happens if the unfortunate event that led to the loss of data also results in a loss of the keys? Encrypted backups without the keys are about as useful as a wad of cash when you are stranded on a deserted island. It seems like they should be worth something, but trying to use them proves futile. Even if you were to store the money away until you were rescued, by the time that happened, inflation would make the wad of cash practically worthless, but here, the analogy kind of breaks down.