Recently, online storage space startup divShare announced on their blog a recent security breach by "a malicious user." Lucky for them, only basic profile information available through the database was accessed during the intrusion. But the important question here is what else could have been taken by a more skilled trespasser?
Many people think that backup is a simple application – what's so hard about backing up a PC? I remember one of my MIT students grousing about Google's success: "Anyone can write a search engine," he said. Backing up the data is not the problem. The problem is dealing with huge volumes, millions of database transactions, hundreds of thousands of customers, and all the complexity that this implies – all while making sure that there is 100% security. Carbonite backs up over 50 million new files every day without losing any of them. Like any other web site, we constantly get attacked by hackers, but we have enough security measures in place that these attacks are always unsuccessful. As I mentioned in a previous post, Carbonite was one of only two backup services that the guys at Heise Security weren’t able to crack.
If you’re doing your engineering properly, online backup can be made to be extremely secure. For instance, Carbonite starts with encrypting the data BEFORE it leaves your PC so that by the time we get it, it's already useless to an intruder in the very unlikely event that someone acutally gains access to our system. We also make sure that the authentication is rock solid, so that there are no "man in the middle" vulnerabilities. And, we actually pay people to constantly test our defenses.
After we get your encrypted files, we want to make sure that we don't lose them, so we store all your data on RAID-6 redundant arrays that are 36 million times more reliable than a single drive. The main Carbonite data center is located in a "bomb-proof" building, alongside those of major Boston financial institutions and telco companies.
Online backup is a hot area right now and you'll see more startups entering the space over the next couple of years. Not all of them will know enough about security to be really bullet-proof. It isn't easy or cheap, but I can tell you that for Carbonite it's a live-or-die proposition.
— Dave
CEO, Carbonite
