It does no good if your client and server authenticate each other, only to find out that someone has intercepted the backup data. This is especially important if your backup data travels over an unsecured network, such as over the Internet from a regional office to headquarters.
Over the past few years there have been well-publicized events where companies lose track of their backup tapes. Often these involve the loss of sensitive financial information. In one such incident in 2005, a well-known time-share company lost backup tapes with sensitive financial information for 260,000 of its customers. Obviously the potential damage to the customers was huge, as well as the damage to the time-share company and its reputation.
Your backup software should provide flexibility to encrypt data in transit before it is sent on a wire, or at rest when data is written to the backup media. It should use freely-available, verifiable methods of encryption. You should also have the option to use different encryption methods and take advantage of new developments and encryption algorithms.
There are hardware-based solutions. Both Network Appliance's Decru division, and Neoscale offer hardware appliances that intercept writes to backup media (tape) and encrypt it on the fly. This has the advantage of speed, but comes at a high infrastructure cost.
Amanda has the ability to encrypt the data either on the client, prior to transmission to the backup server, or on the backup server itself. Both client- and server-side encryption can use any encryption program that reads from standard input and writes to standard output. This includes the aespipe command, which supports a variety of AES encryption routines. Another commonly used tool with Amanda encryption program is gpg.
Of course, without good key management the data cannot be recovered. Amanda does not provide a key management solution on its own but rather works with any key management solution mandated by your IT policy.
The openness and flexibility of encryption options allows Amanda to fit well into security policies and processes of most IT environments including organizations with strict security requirements.