<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Hi Everyone<br>
<br>
Thanks for your comments. I have also spoken to colleagues in IT
and the "general" policy appears to be companies are using VPN and
as much data as possible is being kept on in house servers.
Computers/laptops etc. are fully encrypted and external storage
devices are not an option.<br>
<br>
It is not as clear cut when it comes to data not on the server.
Some companies do backup files held on the device, others don't
because they are trying to get users to use VPN.<br>
<br>
I think we will be looking at VPN with some sort of file backup,
as a backup!<br>
<br>
What to use? Well, management have asked the Council to install a
solution because there is just me covering two schools so I don't
think it will be an open source solution.<br>
<br>
For your information, I have been testing:<br>
<br>
FreeFileSync <a href="https://www.freefilesync.org/">https://www.freefilesync.org/</a><br>
<br>
Very good, lots of features.<br>
<br>
Urbackup <a href="https://www.urbackup.org/">https://www.urbackup.org/</a><br>
<br>
Very promising. The only open source backup solution I have been
able to get running in minutes.<br>
<br>
Regards<br>
<br>
Kevin<br>
<br>
<br>
<br>
On 30/06/17 15:57, J Fernyhough via Lincoln wrote:<br>
</div>
<blockquote class=" cite"
id="mid_CAAsys0cx5AXBGoQq_xbn1hZp5QkvGf_HX51x9HeQf8uzmT_S6A_mail_gmail_com"
cite="mid:CAAsys0cx5AXBGoQq=xbn1hZp5QkvGf-HX51x9HeQf8uzmT+S6A@mail.gmail.com"
type="cite">
<pre wrap="">Ah, a meaty reply. :)
On 30 June 2017 at 14:18, Terry Froy via Lincoln LUG via Lincoln
<a class="moz-txt-link-rfc2396E" href="mailto:lincoln@mailman.lug.org.uk"><lincoln@mailman.lug.org.uk></a> wrote:
</pre>
<blockquote class=" cite" id="Cite_5363416" type="cite">
<pre wrap="">Nextcloud is PHP running on a webserver (in this case, nginx) which
stores data in MariaDB (replicated via Galera cluster) and a
CephFS-based filesystem... it definitely scales!
</pre>
</blockquote>
<pre wrap="">The application scales - I'm more concerned about the file storage.
</pre>
<blockquote class=" cite" id="Cite_5793108" type="cite">
<pre wrap="">Nextcloud provides for another copy of the data, on a
different machine
</pre>
</blockquote>
<pre wrap="">How do you deal with conflicts and canonical versions in this case?
</pre>
<blockquote class=" cite" id="Cite_2993875" type="cite">
<pre wrap="">Nextcloud is about data access and permits mobile clients to
transparently upload/download/sync their data back to base - wherever
they are - and using protocols which are unlikely to be blocked in a
third-world coffee shop.
</pre>
</blockquote>
<pre wrap="">Why are you using a company laptop on an insecure wifi network? :P
</pre>
<blockquote class=" cite" id="Cite_4686932" type="cite">
<pre wrap="">You might as well make the argument that online banking and web-based
e-mail are a bad idea too!
</pre>
</blockquote>
<pre wrap="">Not really. A bank providing online banking knows it has to be secure.
Web-based email isn't all that much different to POP/IMAP (and can
easily be made more secure via e.g. 2FA).
</pre>
<blockquote class=" cite" id="Cite_5333338" type="cite">
<pre wrap="">Any security-conscious company should be operating their own X.509 CA
with root CA keys held in a hardware security module and insisting that
all forms of remote access uses it; the only inbound connections
permitted into our corporate network are HTTPS, IMAPS, SMTPS and SSH -
and SSH forces use of key-based authentication - with the other
protocols using our own X.509 CA for trust/encryption and clients
optionally using X.509 certs for authentication.
</pre>
</blockquote>
<pre wrap="">Yes!
</pre>
<blockquote class=" cite" id="Cite_212632" type="cite">
<pre wrap="">Your 'you have only one thing to monitor and keep secure' is a dangerous
approach to take; this line of thinking has been responsible for the
meltdown of NHSnet during the recent WannaCry ransomware outbreak as a
hard outer shell does little to protect the egg once it has been
compromised.
</pre>
</blockquote>
<pre wrap="">I didn't mean you ignore everything else - I meant more that you're
not spreading your watch/efforts over multiple disparate
externally-facing services (similar to having an SSH bastion host vs
all devices externally accessible). Network segmentation, e.g., is
still important.
</pre>
<blockquote class=" cite" id="Cite_3006242" type="cite">
<pre wrap="">A 'single ingress' is also a bad idea if you are running a multi-homed
Internet Service Provider network like we are ;-)
We run multiple X.509 IPsec/L2TP endpoints at each of our PoPs and for
some access (access to customer PII data), we insist on connectivity via
one of those endpoints, but for other less-critical access, we are happy
for that to come in via the Internet from a trusted X.509 client
certificate or trusted SSH key.
</pre>
</blockquote>
<pre wrap="">I don't run an ISP but I'm glad you know what you're doing. :D
J
</pre>
</blockquote>
<p><br>
</p>
</body>
</html>