Detections
Analytics

2.1.4 The Backups Should be Properly Secured

Information

The backup files will contain all data in the databases. File system permissions and/or encryption should be used to prevent unauthorized users from gaining access to the backups.

Backups should be considered sensitive information. If an unauthorized user can access backups, then they have access to all data in the database. This is true for unencrypted backups and for encrypted backups if the encryption key is stored along with the backup.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Implement encryption, properly restrict file system permissions, protect and backup encryption keys.

 - Restrict file and directory permissions so backup files are accessible only to the MySQL service account and designated backup users, for example:
$ chmod -R 640 <path_to_backups_directory>
$ chown -R mysql:<backup_group> <path_to_backups_directory>

 - If a third-party encryption tool is used, ensure the encryption key is stored separately from the backup files.
 - Ensure the encryption key or passphrase is strong and non-guessable.
 - If backups are stored offsite, ensure access is limited to authorized personnel and the storage medium or transfer is itself encrypted.

See Also

https://workbench.cisecurity.org/benchmarks/22688

Item Details

Category: CONTINGENCY PLANNING, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CP-9, 800-53|SC-28, CSCv7|10.4

Plugin: Unix

Control ID: 17f8186d432cf1e712dbe7eedcf4b1377ee18e52050d2d5ce105f359b8885c7c