Backup software has configuration files that store passwords and access control rights not just for file servers but also for application and database servers. Make sure these configuration files are readable only by authorized users.
Everyone who uses a closed-source software product can only guess what is inside of it. Since the vendor does not make the code available for inspection it is very difficult to tell if the software is totally secure, or if there are back doors coded into the software such as infamous back door discovered in Microsoft IIS servers in 2000.
The United States Computer Emergency Readiness Team (US-CERT) issues the vulnerability alerts for commercial backup software all the time. For example, the Vulnerability Note VU#744137 alerts that in Symantec Veritas NetBackup software the catalog daemon contains a stack-based buffer overflow that could allow a remote attacker to execute arbitrary code on a NetBackup master server.
Open source, on the other hand, is almost impervious to this kind of problem. There is a built-in mechanism of peer review of the code that virtually insures that nothing that is unnecessary is included. No self-respecting Open Source developer would risk his reputation and career by putting a back door into an open source product. Even if such a back door were included, it would mostly likely be quickly found and removed.
Additionally, open source software can be easily inspected for both quality and security. There are both commercial and freely available open source tools for analyzing software code for security vulnerabilities. Some of these are:
Rough Auditing Tool for Security (RATS)
ITS4 by Cigital
Flawfinder by David A. Wheeler.
These tools are freely available, and able to scan a variety of programming languages. Bogosec (http://bogosec.sourceforge.net/index.html) is a wrapper around these tools, and can predict security concerns in software. However, without available source code for backup software, these tools are useless.
When it comes to information security these are very real concerns for any backup package. When selecting a backup package you have to make sure there are no known security flaws in the software. Amanda, the leading open source backup package, has been tested with a variety of tools and by several organizations. For example, Coverity (http://scan.coverity.com), a collaborative effort between Stanford University and the open source community, tested Amanda code quality. When bugs were discovered the Amanda community quickly corrected them and reduced the count to zero. This compares to an average defect rate of 20 to 30 bugs per 1000 lines of code for commercial software, according to Carnegie Mellon University's CyLab Sustainable Computing Consortium.