Backup Encryption

Hardly a week goes by without some story in the news about a company leaking important data through loss of their backup tapes. Whether it is through malicious theft, opportunistic snatching, or accidental misplacement, there is a huge cost to a business when data is lost. When the data contains sensitive information about members of the public, possibly including bank account and credit card numbers, the cost can be severe indeed. Simply the stigma of having to notify clients that you've lost their data is extremely damaging.

For example, in June 2005, Citigroup was forced to issue a media statement admitting that tapes containing personal information on 3.9 million customers had been lost while the tapes were being carried to another site.

In July 2006, Chase staff accidentally discarded five computer tapes containing personal information and financial records of 2.6 million Circuit City credit card account holders. Even though the tapes were in a locked box, the company was forced to release a public statement and notify and compensate all of those customers.

And this threat isn't new at all. In 1977, a disgruntled systems administrator at Imperial Chemical Industries (ICI) in the UK stole a set of backup tapes and attempted to extort a large amount of money from the company for their return. He was eventually captured.

Despite the obvious and well-known risks, I've found that few companies actually use encryption to protect their backups. This is quite surprising to me, considering how easy it is to do and just how costly it is to lose data. In this article, I'll show you how to add encryption to your backups, and I'll describe some of the pitfalls to watch out for.