Backup practices refer to the processes, policies, and procedures an organization puts in place to create copies of data to protect against data loss. Implementing robust backup practices is a crucial part of any organization’s data protection strategy.
Why are backup practices important?
There are several key reasons why organizations need to have strong backup practices:
- Protect against data loss – Backups provide a way to restore data that has been corrupted, deleted, or made inaccessible. Without backups, data loss can be catastrophic.
- Recover from disasters – Backups allow you to recover data and systems in the event of a disaster like a ransomware attack, equipment failure, natural disaster, or human error. Backups are a key part of business continuity.
- Meet compliance requirements – Many regulations and industry standards require retaining copies of critical data for a certain time period. Backups help satisfy these compliance needs.
- Provide data auditability – Backups can provide a historical view of data changes over time for auditing and forensic analysis.
- Enable data reuse – Backups make it easy to reuse data for things like testing, analytics, reporting, and more.
Without solid backup practices, an organization is vulnerable to potentially severe consequences including revenue loss, reputational damage, regulatory penalties, and more if data is lost.
Elements of a backup strategy
A comprehensive backup strategy consists of several core elements:
1. Identify critical data
Organizations should identify their most important data that absolutely must be backed up. This typically includes things like:
- Databases
- File servers
- Email servers
- Application and web servers
- Source code repositories
- File shares and networked drives
Understanding the criticality of different data will guide decisions on backup frequency, retention policies, storage locations, and more.
2. Select backup types
There are different types of backup strategies to consider:
- Full backups – A complete copy of the data source. Useful for full system restores but take more time and storage.
- Incremental backups – Only the data changed since the last full or incremental backup. Faster but require more management.
- Differential backups – Copies all data changed since the last full backup. Provides faster restores than incrementals.
- Snapshots – Point-in-time read-only copies. Helpful for quick restores.
Organizations may use a mix of these backup types depending on their specific needs and infrastructure.
3. Define frequency schedule
The frequency of backups should be determined based on data criticality and the organization’s Recovery Point Objective (RPO) – how much data loss is acceptable before normal operations must resume. Some common frequencies include:
- Databases – Daily incremental, weekly full
- File servers – Daily incremental, weekly full
- Email servers – Daily full
- Source code – Several times per day or with every code commit
4. Establish retention policies
Retention policies specify how long backup data will be stored before it is deleted. This depends on the organization’s Recovery Time Objective (RTO) – how far back in time they need to restore. Some common retention times include:
- Daily backups – 1 week
- Weekly backups – 1 month
- Monthly backups – 12 months
- Yearly backups – 3-7 years
Regulatory requirements may also dictate retention rules.
5. Select storage media
Common backup destination media includes:
- Disk (NAS, SAN)
- Removable Disk (USB drive, DVD)
- Tape
- Cloud storage
Each have different costs, scalability, access speeds, portability and lifespan tradeoffs.
6. Choose backup software
Backup software automates the backup process. Key features include:
- Scheduling backups
- Compressing and encrypting data
- Managing storage media
- Sending alerts
- Producing reports
- Integrating with various data sources
- Self-service restores
Leading enterprise backup tools include Veeam, Commvault, Veritas NetBackup, and more.
7. Document policies and procedures
Write out clear policies, procedures and documentation covering:
- Scope – What systems and data are backed up
- Responsibilities – Who is accountable for what
- Frequency schedule
- Retention rules
- Mapping of data to backup locations
- Backup monitoring processes
- Validation testing steps
- Restore request process
This documentation serves as a reference and training guide for IT teams and facilitates compliance.
8. Regularly test restores
The only way to verify backups are working as intended is to regularly perform test restores. This should be done on a defined schedule, such as quarterly. Test restores can identify backup failures, system configuration issues, tape drive problems, and more.
9. Monitor and audit backups
Backup platforms should provide monitoring, reporting and alerting capabilities. Backup logs should be audited to identify potential issues like failed jobs, performance bottlenecks, or retention policy non-compliance.
10. Evaluate offsite storage
For protection against site disasters, backups should be copied to secure offsite storage on a regular basis. Options include:
- Physical transport of tapes/disks to offsite vaults
- Backup replication to a secondary site
- Cloud storage
Data backup best practices
Beyond core backup strategy elements, organizations should follow these best practices:
- Automate backups – Manual backups are error prone. Backup software automates the process.
- Encrypt backups – Encryption protects backup data against unauthorized access.
- Use dedicated backup media – Backup storage should not be dual-purposed, eg as production storage.
- Manage media – There should be processes to manage media like taping cycling and tape vaulting.
- Send alerts on failures – Backup failures, errors, missed jobs should trigger email/SMS alerts.
- Log backup activity – Backup platforms should produce logs to troubleshoot issues.
- Validate backups – Hash/checksum algorithms can validate backup integrity.
- Test restores – The only way to know backups work is to regularly test restores.
- Follow the 3-2-1 rule – Maintain 3 copies, on 2 media types, with 1 offsite.
Backup infrastructure options
Organizations have several infrastructure options for configuring backups, including:
In-house backups
- Using backup software and internal storage media
- Pros – Maximum control, configurable to needs
- Cons – CapEx costs, IT overhead to manage
Cloud backups
- Backup software replicates data to cloud object storage
- Pros – No hardware to manage, elastic storage, lower costs
- Cons – Dependent on internet bandwidth, data retrieval fees
Hybrid backups
- Combine in-house backups with cloud backups
- Pros – Balance of control and costs
- Cons – Added complexity of hybrid environment
Backup-as-a-Service (BaaS)
- Managed backup service from a provider
- Pros – Fully outsourced, predictable costs
- Cons – Vendor lock-in, less control
The optimal approach depends on IT resources, cost parameters, and risk tolerance.
Creating a backup plan
Developing a successful backup plan involves these key steps:
- Document backup requirements – Identify critical systems, RPOs/RTOs, regulatory rules, etc.
- Evaluate data to backup – Catalog, classify, and prioritize data for inclusion.
- Choose backup types and frequencies – Select appropriate techniques and schedules.
- Define retention policies – Determine how long backups must be stored based on needs and compliance.
- Calculate storage needs – Project storage capacity requirements over time.
- Select backup infrastructure – On-premises, cloud, or hybrid model.
- Pick backup software – Assess solution capabilities and integration requirements.
- Assign responsibilities – Designate backup admin(s), stakeholders, end users roles.
- Document policies and procedures – Detail the backup/restore processes for IT and users.
- Schedule testing regimen – Devise tests to validate backup integrity.
- Train staff – Educate IT and end users on backup best practices.
- Continuously improve – Audit backups, refine plan, watch for gaps.
Plans should be revisited periodically as the IT environment evolves.
Maintaining effective backups
Some best practices for maintaining backups include:
- Monitor backup software alerts, logs, and reports
- Periodically test restores from backup media
- Validate encryption and security controls
- Watch for unprotected data sources
- Verify data integrity with checksums
- Cycle media like tapes on defined schedules
- Identify backup performance bottlenecks
- Document backup configurations and settings
- Assess staff backup knowledge and provide training
- Send backups offsite on a regular cadence
Proactive maintenance processes reduce the risks of backup failures and lengthen the lifespan of backups.
Data backup solutions
Leading technology vendors offer data protection solutions suitable for organizations of all sizes, including:
| Vendor | Sample Products |
|---|---|
| Dell EMC | NetWorker, Avamar, Data Domain |
| Veritas | NetBackup, Backup Exec |
| Veeam | Veeam Backup & Replication |
| Commvault | Commvault Complete Backup & Recovery |
| Cohesity | DataProtect, DataPlatform |
| Rubrik | Rubrik Cloud Data Management |
| MSP360 | Backup Solution, Cloud Backup |
Open source backup options like Bacula and Amanda offer lower cost alternatives appropriate for some use cases.
Cloud backup services
Popular cloud backup services include:
- Amazon S3 Glacier – Part of AWS storage portfolio
- Backblaze B2 Cloud Storage
- Microsoft Azure Blob Storage
- Wasabi Hot Cloud Storage
- Oracle Cloud Infrastructure Object Storage
- IBM Cloud Object Storage
- Google Cloud Storage
Many backup software tools integrate with these cloud storage platforms to enable hybrid or cloud-only backups.
Conclusion
Implementing sound backup practices is a fundamental data protection requirement for modern organizations. Backups guard against data loss from cybercrime, hardware failures, natural disasters and human error. Organizations should invest in backup solutions that match their budget, skill set and performance needs. With robust policies, validated backup systems, and proper monitoring controls in place, companies can ensure their valuable business data is protected and recoverable.