Encrypting backups: why it matters and how to manage the keys

A backup is everything in one place

Think about what a full backup contains: every client file, every email, payroll records, bank details, staff contracts, perhaps health or legal information. If someone obtained a copy of that backup, they would have more than they could get by breaking into any single computer. That makes backups an attractive target, whether it is a portable drive stolen from a car, a misconfigured cloud bucket, or an attacker who has reached the backup server on your network.

Encryption means that a stolen or exposed copy is unreadable without the key. Under the Privacy Act 2020, it can also make the difference between a lost drive being a serious privacy breach that must be reported and an unfortunate but contained incident, because encrypted data that cannot be read is far less likely to cause harm.

In transit and at rest

Encryption in transit protects data while it travels from your systems to the backup destination, usually over the internet. Reputable cloud backup services do this by default using standard secure connections. Encryption at rest protects data where it is stored: on the backup provider's servers, on a local backup appliance, or on an external drive. Both are needed, because the risks are different.

Check how at-rest encryption is handled. Some services encrypt with keys they manage, which protects against physical theft from their data centre but means the provider could technically read your data. Others let you set your own key or passphrase, so even the provider cannot read it. The second is stronger, but places more responsibility on you.

The key problem

The most common way encrypted backups fail is not hacking; it is a lost key. The person who set up the backup chose a strong passphrase, stored it in their head or on the server being backed up, and then left the business or the server died. When the restore is needed, nobody can unlock the backup. The data is perfectly safe and completely useless.

Treat the encryption key as one of the most important pieces of information the business owns. Store it in a business password manager with access for at least two named people, and also keep a sealed, offline record in a safe or with a lawyer or accountant. Never keep the only copy on a system that is itself being backed up.

Portable drives and offline copies

If you rotate external drives as an offline backup, encrypt them. A drive left in a car or taken home is easy to lose, and an unencrypted one hands its contents to whoever finds it. Most backup software can encrypt the backup files themselves, and operating systems offer full-drive encryption for removable disks. Label drives with a code rather than the company name or contents.

Test that an encrypted drive can be unlocked and restored on a different computer, not just the one that created it. That proves the key and the process work, and that you are not relying on something stored only on the original machine. Repeat the check whenever the person responsible for rotating drives changes, because a new person may not know where the key lives.

Encryption does not replace other protection

Encryption stops someone reading a stolen copy. It does not stop ransomware deleting or re-encrypting your backups, and it does not protect a backup that an attacker can log in to with your credentials. You still need separate, multi-factor-protected backup accounts, an immutable or offline copy and regular test restores.

Also remember that a restored backup is decrypted. When you restore data to a test environment or a temporary laptop, treat that machine as holding sensitive information and clean it up afterwards. The same goes for files copied onto a USB stick to hand to a colleague during a restore. Delete or securely wipe these temporary copies once the job is done, and record that you did.

Questions to check with your provider

Ask whether data is encrypted in transit and at rest, which standard is used, who holds the keys, whether you can set your own passphrase, what happens if you lose it, and where the data is physically stored. Ask too how the provider controls its own staff's access to customer backups and whether that access is logged.

Write down the answers and the location of the keys, and include them in your disaster recovery plan. When an emergency comes, the person restoring the backup needs to know exactly where to find the key without guessing. That one line in the plan can save days. Review the record when staff with access to the keys change roles or leave, and confirm the replacement person can retrieve them.