Is Backup Enough?
Having backups sounds reassuring.
Files get copied to another server, data is stored frequently, and backups may automatically run every night.
So far, on paper at least, all seems under control.
However, another much more important question is
Are those backups usable?
A backup that you cannot use during an incident is not worth much at all.
Backup and Restore Are Different
What is Backup Data?
A backup is copied data located in some other place.
Restoring means that you have taken that copy and made it usable again.
That difference is important.
For example, a company may back up the customer database every day.
However, if the server crashes and the backup file is corrupt or missing or if restoring it takes six hours, the company still faces a serious problem.
Like an emergency exit in an office.
Even if the sign is there, you can never really be sure it will work in an emergency unless someone actually confirmed that the door opened.
Why Recovery Testing Matters?
This is why companies conduct recovery testing.
To not take for granted the fact that a backup works, they perform the restore in a test environment and verify some basic items:
Can the files be opened?
Is the data complete?
Get @dsfglobal’s stories in your inbox
Join Medium for free to get updates from this writer.
Pride is a long time coming when restoring the system.
Testing is the only way to confirm a backup has a chance of working when it matters.
RPO and RTO
In backup planning, we hear two ubiquitous terms: RPO and RTO.
For example, the Recovery Point Objective (RPO) measures how much data your company can afford to lose.
Assuming you are backing up once every 24 hours, nearly a full day’s worth of new data could be lost if something goes terribly wrong moments before the next backup is done.
RTO Recovery Time Objective refers to how fast the system needs to recover.
While the backup may be just fine, if it takes two days to restore, well, that’s still a significant business issue.
The question is: how do you know for sure that the backup exists? It is equally important that the company rebounds from it quickly.
Ransomware Can Target Backups Too
Prior to commencing a ransomware attack, attackers may also delete or encrypt backups.
Thus, some organisations utilise immutable backups.
Immutable backup means that no one will be able to change or delete a file for a defined time period. In the event an attacker gets access to administrative rights, they might still not be able to destroy all the recovery copies.
The true test really begins with recovery
While backups are necessary, making them is only half of the job.
This is where their true worth comes in whenever something goes wrong.
A company should understand what got backed up, that the backup can be restored, and when it will have full recovery.
So instead of asking:
“Do we have a backup?”
A better question is:
If our system fails today, can we make it back?
Disclaimer
This article is for informational purposes only; it does not constitute legal, technical, business, or security-related advice.
