John is implementing a commercial backup solution for his organization. Which of the following steps should be on the configuration checklist?

When implementing a commercial backup solution, enabling encryption is a critical security control. Backups contain a complete, point-in-time copy of sensitive organizational data. If this data is not encrypted at rest on the backup media, it is vulnerable to unauthorized access if the media is lost, stolen, or the storage system is compromised. Most reputable commercial solutions offer strong, standardized encryption (e.g., AES-256), and enabling it is a fundamental step in any secure configuration checklist to ensure data confidentiality.

B. Disable software-level encryption to increase speed of transfer: Disabling encryption sacrifices essential data confidentiality for a potential performance gain, which is an unacceptable security trade-off for sensitive organizational data.

C. Develop a unique encryption scheme: Creating custom cryptographic schemes is a well-known anti-pattern ("don't roll your own crypto") as they are highly likely to contain vulnerabilities that are avoided by using standardized, peer-reviewed algorithms.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (Special Publication 800-53, Rev. 5).

Page 281, Control SC-28 (Protection of Information at Rest): This control mandates the protection of the confidentiality and integrity of information at rest. The discussion section explicitly notes that encryption is a primary method for achieving this. Backups are a form of information at rest.

2. Amazon Web Services (AWS). (2023). AWS Backup Developer Guide.

Section: Data protection in AWS Backup: The documentation states, "Data protection refers to protecting data while in transit (as it travels to and from AWS Backup) and at rest (while it is stored in AWS data centers)... AWS Backup encrypts your backups at rest." This highlights encryption as a default and essential feature of a commercial backup service.

3. Microsoft Azure. (2023). Azure Backup security features.

Section: Encryption of backup data: The official documentation states, "Encryption protects your data and helps you to meet your organizational security and compliance commitments... By default, all your data is encrypted at rest using service-managed keys." This reinforces that encryption is a standard and necessary component of a secure backup strategy.

4. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE, 63(9), 1278–1308.

Section V-A-1, Design Principle: Least privilege: While an older source, this foundational paper outlines core security principles. Encrypting backups aligns with the principle of least privilege by ensuring that even someone with physical access to the media cannot access the information without the key, thereby restricting access to the data itself. (DOI: 10.1109/PROC.1975.9939)