Secure Remote Storage Recommendations

radderfire · 29 Aug 2010 at 14:54

Hi All

I'm looking for some secure remote storage at reasonable monthly cost so that I can back up all my important data remotely. I guess one of my main concerns is the security aspect as it is business data I will be backing up.

Does anyone have any recommendations?

Thanks

tntcoder · 29 Aug 2010 at 15:25

Your only real option is to encrypt it before you upload it remotely. I wouldn't recommend trusting any remote storage provider with unencrypted business data.

Dropbox is very good and very easy to use, you can get 1gb free, or 100gb for $200 a year. Couple that with something like Truecrypt and you will be fine.

Live Drive is also supposed to be very good: http://www.livedrive.com/ - £90/year for 'unlimited' storage.

But basically, do the security yourself rather than trusting a storage company.

theheyes · 29 Aug 2010 at 16:19

If that business data includes personal data then you need to be careful about where it is hosted (geographically), and I'd certainly want to encrypt the backups myself.

MarcLister · 29 Aug 2010 at 18:03

I'd encrypt anything you want stored/backed up. TrueCrypt would do the job. Even if a company like Dropbox promises to be able to encrypt and keep your files/data safe I'd still be inclined to encrypt stuff myself so that if anything happens to the storage in terms of privacy then you've still got yourself a layer of protection.

theheyes said:
If that business data includes personal data then you need to be careful about where it is hosted (geographically)

I assume you mean in terms of countries which have laws that allow law enforcement organisations to require you to unencrypt any encrypted files or to give them the key(s) to do so? If so, good shout.

lord filbuster · 29 Aug 2010 at 18:28

MarcLister said:
I'd encrypt anything you want stored/backed up. TrueCrypt would do the job. Even if a company like Dropbox promises to be able to encrypt and keep your files/data safe I'd still be inclined to encrypt stuff myself so that if anything happens to the storage in terms of privacy then you've still got yourself a layer of protection.

I assume you mean in terms of countries which have laws that allow law enforcement organisations to require you to unencrypt any encrypted files or to give them the key(s) to do so? If so, good shout.

I think he probably means be careful to avoid violating the data protection act. Besides, you can already be forced to give encryption keys up in the UK.

MarcLister · 29 Aug 2010 at 18:38

lord filbuster said:
I think he probably means be careful to avoid violating the data protection act. Besides, you can already be forced to give encryption keys up in the UK.

I was also thinking about the DPA, honest!

I've always thought that Russian or Chinese storage are quite good.

In terms of not having to give up encryption keys like you do here. And its RIPA 2000 that gives the law enforcement authorities here the right to demand encryption keys isn't it?

tntcoder · 29 Aug 2010 at 19:02

MarcLister said:
I was also thinking about the DPA, honest!

I've always thought that Russian or Chinese storage are quite good. In terms of not having to give up encryption keys like you do here. And its RIPA 2000 that gives the law enforcement authorities here the right to demand encryption keys isn't it?

Yep, RIPA 2000 is correct.

I wonder if authorities could intercept the upload before it leaves the UKs boundaries and then request the keys

theheyes · 29 Aug 2010 at 19:47

Yes, I was referring to the DPA. It would be good if someone in the know could shed some light on whether uploading an encrypted blob is acceptable in the context of data protection? My cursory search didn't give me much information either way.

tntcoder · 29 Aug 2010 at 19:56

theheyes said:
Yes, I was referring to the DPA. It would be good if someone in the know could shed some light on whether uploading an encrypted blob is acceptable in the context of data protection? My cursory search didn't give me much information either way.

Yer encryption changes nothing with the DPA location wise (for better or worse). You are limited to storage within the European Economic Area unless special exemptions apply to your business specifically.

I think it's assumed that the clause containing "Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data" indicates data should be protected anyhow, with encryption.