In the previous post on categories and priorities of personal files I described how I do classify my files by the ways I handle their safety and security. Now it’s time to describe some of the specific approaches: security of sensitive (private, secret, classified) information.
The difference between security and safety may be non-obvious for some people, so I will describe my vision on this (I may be wrong – correct me then please). “Safety” means the information must not be lost; the loss of information is a fail. “Security” means the information must not be leaked; it is better to be lost or destroyed, but not leaked.
As it is seen now, these goals conflict with each other a bit, but one (me or you or someone else) has to find a balance of security and safety for each category of the files or for some files directly. And here is the essay on how I solve this dilemma and ensure the security.
Groups of sensitivity
To remind the categories of files, here they are with their subjective sensitivity for the leak (where 10 is for “a nightmare”, and zero is for “nobody cares”):
- Passwords — 10
- System backups — 10
- Operational documents — 9
- Exchange information — 5
- Photo archives — 5
- Source codes — 1
- Media archives — 0
As you can see, here are three distinct and isolated groups: very sensitive (9-10), averagely sensitive (5), and not sensitive (0-1) information. It is actually my luck that these groups are so distinct and I’m not bothered with manual distinction of “7 vs 8” or so.
But despite of these distinct groups, each file category is handled in its own way.
But despite of these specific ways, I use 2 (two) tools only, and actually 1 (one) is enough.
Encryption Tools
The tools I use are: TrueCrypt and AxCrypt (both are for MS Windows).
TrueCrypt is a utility to make encrypted disks either on physical disk partitions, or in normal files. I use only file containers actually, and haven’t met the need to use partition containers yet (partially because I don’t trust to physical devices).
Until I’ve found AxCrypt software, I used TrueCrypt for each and every sensitive file, but in different containers of different sizes and with different passwords: “papers.tc” for scans and official documents, “passwords.tc” for web passwords and keys, “financial.tc” for bank passwords and credit card information, so on.
AxCrypt is much similar to TrueCrypt in its purposes, but operates on individual files. You have no need to mount or unmount any virtual disk to work with the encrypted file. You just launch this file, AxCrypt asks for a password (if it has no one in a cache already), stores the file into temporary folder, and launches suggested application by file extension; when the work is done, it encrypts the file back to its original encrypted location.
The only difference in these approaches (except for encryption strength and other math-related aspects) is the exposure of file listings: with TrueCrypt you have a “black box” (with false bottom if you want) and nobody knows what is inside there; with AxCrypt everybody knows what is this or what it should be at least, but nobody actually can see it.
You must admit that this difference is not significant and can be easily emulated with encrypted ZIP archive, for example. And so it is.
Significant differences are only those on usability and the ways we use the software. For example, AxCrypt can not be mounted as a disk for a long and massive work without unpacking files into unreliable temporary folder. Anyway, it is a matter of customs what to use.
Online and Offline Security
Since I try to migrate from local (in-house and in-pocket) storage devices to online storages, security and safety of private information becomes important. I will never trust all my passwords or credit card numbers to any web service (except financial ones: PayPal, Assist, so on).
I want to trust, but I cannot. All these services are made by people and are served by people. And people are the most unreliable link in a chain. They can steal the information for themselves, or re-sell it on a black market (credit cards are the most wished, but passwords to accounts are sell-able too).
More on that, even the disk devices you own can be lost, stolen, secretly duplicated with nanomolecular replicator. So that is why I store all my sensitive files encrypted all the time, but not only when I go outdoors.
And here my distinct “groups of security sensitivity” come to the play.
Encryption by Security Group
Everything with high sensitivity is stored encrypted:
- passwords and financial credentials — with TrueCrypt to hide them completely and to prevent storing them into temporarily folders when accessing them; also, “false bottom” is used for financial information;
- operational documents — with AxCrypt for easy per-document access with affecting all other documents nearby on the storage;
- system backups are usually either archives or disk images are their internal content is never accessed directly, so they can be encrypted with AxCrypt (I haven’t configured that yet).
Fortunately, two of three high-sensitive categories — passwords and system backups — can be easily lost or destroyed in case of danger, thus solving the dilemma of security vs. safety. Passwords can be recovered later within web services, financial credentials can be written down from physical cards, and system can be backed up again (or reinstalled from scratch in pessimistic scenario). All of this will take a lot of time, but will not compromise me or my values.
Regarding operational documents… Well, you have to decide what to do and how sensitive they are, each of them. Good side is that documents (so as passwords) are usually small and can be backed up multiple times to multiple places to be recovered later (maybe slightly outdated, but not completely lost).
Files with average sensitivity are not encrypted because there are a lot of them and it will be hard to encrypt and decrypt them each time when they are accessed, so as to remember the passwords for this. But if there ever will be a storage service with on-the-fly transparent encryption, these files will go there.
As for now, they are just handled “with care”: they are never directly placed on an unreliable computers, are always removed from flash drive before giving it away to somebody; those files on the web services are “protected” by properly logging out when you leave the computer or by just locking it.
Low-sensitivity files are not encrypted at all and are not supposed to be encrypted. Actually, they are publicly available in most cases.
Though I have to note that some (usually payed or made by contract) source codes are treated as high-sensitivity information, and are packed with ZIP and encrypted with AxCrypt.