You can also use encryption for direct-connected backup, and password-protected encryption is available with most backup software packages. In the end, the password you choose must be complex--if someone gets control of your physical media, he or she may attempt to perform a dictionary attack against your password. The amount of encryption you use is based on your company policy and may be dictated by specific legal or government-mandated security standards.
"Data storage is always a short-term process," says Bruce Schneier, CTO of Counterpane Internet Security. "In the normal course of business, you won't need to store data long enough to worry about the encryption algorithm being broken. There are many more weaker links." These include poorly written programs that control access to data and personnel malfeasance issues, such as employees intentionally selling or sharing company secrets.
Administration: Getting a Handle
A corporate-centric model offers the most IT control over the backup process by providing reporting, storing data on company servers, and in some cases supporting content-push capabilities and centralized resource management. Some online backup services provide similar reporting and file-distribution options and are IT-friendly. Local-media systems remain the responsibility of the user.
Regardless of the method, the success of your remote backup depends on user cooperation. Sadly, the standard IT philosophy ("If they don't back up, it's their own problem") won't hold up if you're called to explain how that attitude fits with your company's expensive disaster-recovery program.