Archive for June, 2009

Online backup, paradise or perdition.

June 11, 2009

Online backup has become very popular over the last two or three years, with a large number of companies now offering a whole range of services.  This growth had been driven primarily by the increase in low cost, high speed internet access provided by DSL services.  While there are obvious benefits to using an online backup service, there are also a number of considerations that should be taken in to account when planning which service to use and how to use it.

Some of benefits of online backup services are quite obvious, whereas others are less so.  By giving your data to someone else to backup you are saving both the time and money of running your own backup infrastructure.  Additionally, many online backup services allow for continual backup during the day so rather than just being able to restore a file (or email - many services offer Exchange and SQL backup) from last night's backup, you can go back to 30 minutes or an hour ago.  They also normally keep multiple versions of backed up files so you can choose which to restore.  Lastly, the restoration process is usually very simple via either a web browser or a Windows Explorer like interface to the backup application.

However, there are a number of potential drawbacks which must also be considered when looking at these services.  The main point is that these services are generally geared to backing up your data, not your infrastructure.  This makes then great for recovering that accidently deleted file or email, but not much use when your Small Business Server crashes and you need to do a full restore.  While some companies do offer full server backup, would you really want to try and restore 50GB, 100GB or maybe even 500GB over your 8Mbps ADSL internet connection?

The costs of backup services can also vary widely, and its often quite difficult to estimate how much backup space will be needed.  Every company's data storage requirements increase over time and this will clearly lead to an increase in backup costs.  Additionally, once you start to backup files that change on a regular basis, such as you Exchange or SQL databases, the amount of online backup space used can grow quickly, along with the costs.

There are also Data Protection issues to be considered.  Does the online backup company you are using comply with the UK Data Protection legislation?  If you are backing up customer data or information offsite, are YOU complying with UK Data Protection legislation?  These areas will need to be clarified before using an online backup service to avoid potential problems.

Lastly, there are a very large number of companies now offering online backup services that didn't exist two years ago.  Online backup is still a relatively new technology and its highly likely that a number of these companies won't be around two years from now, especially considering the current economic climate.  If you're backing up your data online, you need to have the assurance that the service is still going to be available when you need to do a restore.  Some of the existing, established backup companies such as EMC and Symantec now offer online backup services.  Unfortunately, the Symantec Protection Network is currently only available in the USA and Canada and while EMC's Mozy is available in the UK, it still appears to be geared towards the US market.

Online backup certainly has a lot of benefits and, when used correctly, can be a very cost effective solution.  However, it clearly shouldn't be seen as a replacement for traditional onsite backup solutions, based on tape or disk, but instead be used to complement these solutions and provide an additional layer of protection for your business.

Password blues.

June 10, 2009

For the average computer user, password management often involves either their pet’s name or a selection of Post-It notes on their monitor.  While for some this may be the only way to remember their passwords, there are a number of guidelines that can be followed to ensure users create strong, secure passwords that are also easy to remember without having to write them down.

It’s a popularly held belief that the best passwords are those made up of random strings of upper and lower case letters, numbers, and other symbols.  While these are indeed the most difficult to crack via a brute force attack and tend to be impervious to dictionary attacks, they are also the most difficult to remember and therefore the most likely to be written done.  The most complex password becomes useless when its easily accessible by other people.

The complexity of a password increases exponentially as the password’s length increases.  There are over 10,000 more password combinations for a 15 character password using just lower case letters than there are for an 8 character password using upper and lower case letters, numbers, and all the symbols easily accessible on a normal keyboard.  Therefore, you don’t need to use every character available just to get a complex password.

Many people also don’t realise that Windows passwords can be up to 127 characters long and can also contain a space.  This makes it very easy to construct a complex password, which is in essence a pass phrase, which is easy to remember.  A good way to start is to take a simple phrase, such as “summer is” here and apply some standard rules to it.  For example, you could capitalise the second letter or each word, rather than the first, to make it more difficult to guess.  You could then add a specific symbol at the end of the password.  Lastly, you could substitute specific letters for symbols or numbers (such as “@” for “a” and “5″ for “s”).  This makes the password “5Ummer i5 hEre!” which is very complex and well protected from common password attacks.  If you keep the same set of standard rules, it’s also easy to remember.  Additionally, if you need to write anything down, you can write down the rules rather than the password itself which is a much lower risk.

When you need to change your password, you simply need to select a new phrase and apply the same rules – “now its autumn” would then become “nOw iT5 @Utumn!”, another complex yet easy to remember password.

One last point – there is always going to be a need at some point to write down a password.  Some passwords, such as the Windows Directory Services Restore Mode password, are designed to never be used except in an emergency.  These are therefore going to need to be recorded somewhere to ensure access when needed.  Writing these passwords down is not in itself a security risk – it’s what you do after they are written down that can cause the problem.  Locking the password is a safe with controlled access should present very little risk at all, and as the use of these passwords is very limited, it shouldn’t be a problem if accessing them takes time.