Encrypting backups: protect copies as much as production

Internal audit: daily MySQL backups on shared S3 bucket. Open ACL to dev team. Prod AES — SQL dumps readable to anyone with Friday's AWS keys.

Attackers love backups: less monitoring, historical data, often credentials inside.

Threats on copies

Bucket theft, insider, vendor breach, stolen external drive. Backup encryption = last line.

GDPR: personal copies often in scope.

Strategies

restic/Borg client-side, gpg pipes, Velero KMS, warn mysqldump often plaintext.

Key management

KMS envelope, offline recovery key, quarterly encrypted restore test.

Bad encryption

Weak zip password, GPG key in git, same passphrase prod/backup. Prefer tools with integrity.

Checklist

Inventory plaintext backups, client-side sensitive data, SSE, IAM least privilege, documented restore test.

Encrypted restore test

Quarterly: restore subset to sandbox without prod credentials online. Time RTO. Verify restic/borg check integrity.

Inventory plaintext backups: mysqldump cron, unencrypted panel backup, VM snapshot.

Backup key in vault separate from prod password manager.

Key ceremony

Two-person restore key break-glass. Backup key never on same prod cron machine.

Test: air-gapped laptop restore quarterly.

Host panel "encrypted" backup: ask key custody and if restore possible without 72h support ticket.

Encryption without restore test = folklore.

Restic in production

Restic repo password manager + monthly automated restic check.

Exclude patterns: regenerable cache — backup focus irreplaceable data.

Offsite cross-region copy even if encrypted — datacenter fire flood real.

Operational summary

Encrypt off-site backups client-side (restic/Borg) plus bucket SSE. Keys separate from prod. Quarterly air-gapped restore test. Inventory plaintext SQL dumps.

Panel "encrypted" backup: who holds key?

Plaintext backup audit

Script find unencrypted .sql .tar dumps on prod and CI artifacts. Restic/gpg encryption plan with deadline. Named responsible person.

GDPR: register mentions copy encryption.

Compliance audit

Auditors ask « show restore » not « show encryption checkbox ». Encrypted backup failure mode is same as no backup if key lost — document key escrow.

Separate backup encryption key from disk encryption key — same key = single breach point.

Key custody

Backup encryption key in separate vault from prod DB password. Quarterly restore test from vault-only access workstation proves keys work. Document key version per backup set.

Restic repository password in team vault with break-glass copy sealed offline. Never store in same password manager folder as production admin creds.

Encrypting backups protects confidentiality at rest on object storage — pairing with immutability protects against deletion. Both layers required for ransomware resilience story auditors accept.

Operational follow-up

Include backup encryption in new service onboarding — same bar as prod TLS. Every new dump cron must declare destination and encryptor. Semiannual cron script audit often finds forgotten plaintext mysqldump on old server. Restic, Borg, and gpg each fit different teams — pick one standard, not three parallel backup scripts unearthed during audit. Document gaps between host marketing and field measurement in the quarterly review.

Quarterly follow-up

Include backup encryption in new service onboarding — same bar as prod TLS. Every new dump cron must declare destination and encryptor. Semiannual cron script audit often finds forgotten plaintext mysqldump on old server. Restic, Borg, and gpg each fit different teams — pick one standard, not three parallel backup scripts unearthed during audit. Document gaps between host marketing and field measurement in the quarterly review.

Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.

Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.

Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.

Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.

Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.

Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.

Plaintext audit

Find cleartext .sql prod/CI. restic deadline. Two-custodian escrow. Quarterly air-gapped restore.

Decide and move forward without blind spots

1. Inventory plaintext backups — mysqldump cron, unencrypted panel, VM snapshots listed.
2. Client-side restic or gpg — before off-site send; bucket SSE as additional layer.
3. Backup key off prod — separate vault, two-custodian escrow for sensitive data.
4. Quarterly sandbox restore — time RTO, restic check or equivalent.
5. GDPR register — copy encryption mentioned in processing register.

Backup hosting: compare off-site and KMS via our directory and guides.

Frequently asked questions

Client-side or bucket SSE?

Ideal: both. Client-side (restic, gpg) even if bucket compromised. SSE-S3/KMS for provider layer.

Where to store key?

Never only beside backup. KMS, HSM, team vault, split custody. Test restore without prod key online.

Perf impact?

Modern AES negligible vs compression. Network/disk still bottleneck.

Key rotation?

Re-encrypt plan or multi-key. Document key version in backup metadata.

List plaintext backups this week — the count will surprise you, so will the fix.