312-50V11 · Question #774
Jim's company regularly performs backups of their critical servers. But the company cannot afford to send backup tapes to an off-site vendor for long-term storage and archiving. Instead, Jim's company
The correct answer is A. Encrypt the backup tapes and transport them in a lock box.. Backup tapes in transit must be encrypted for data confidentiality and transported in a lock box for physical security - these two controls together satisfy logical and physical protection requirements.
Question
Jim's company regularly performs backups of their critical servers. But the company cannot afford to send backup tapes to an off-site vendor for long-term storage and archiving. Instead, Jim's company keeps the backup tapes in a safe in the office. Jim's company is audited each year, and the results from this year's audit show a risk because backup tapes are not stored off-site. The Manager of Information Technology has a plan to take the backup tapes home with him and wants to know what two things he can do to secure the backup tapes while in transit?
Options
- AEncrypt the backup tapes and transport them in a lock box.
- BDegauss the backup tapes and transport them in a lock box.
- CHash the backup tapes and transport them in a lock box.
- DEncrypt the backup tapes and use a courier to transport them.
How the community answered
(26 responses)- A88% (23)
- B4% (1)
- D8% (2)
Why each option
Backup tapes in transit must be encrypted for data confidentiality and transported in a lock box for physical security - these two controls together satisfy logical and physical protection requirements.
Encrypting the backup tapes ensures that even if tapes are lost or stolen during transit, the data cannot be read without the decryption key, protecting confidentiality. Transporting them in a lock box adds a physical security control that prevents unauthorized access to the tapes themselves. Together these two controls address both logical and physical security for sensitive data in transit.
Degaussing a magnetic tape permanently erases all data stored on it, destroying the backup entirely and making it useless as a recovery resource.
Hashing the backup tapes only provides an integrity check to detect unauthorized modification, but does not encrypt or protect the confidentiality of the data if the tapes are intercepted.
Using a courier is a method of transport rather than a security control, and does not provide the same level of physical containment and tamper-evidence as a lock box during transit.
Concept tested: Backup tape encryption and physical security controls in transit
Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-111.pdf
Topics
Community Discussion
No community discussion yet for this question.