Most organizations invest heavily in cybersecurity. Yet, their infrastructures remain vulnerable to cyber threats as social engineering and hacking tactics evolve. At least 93% of networks can be breached, according to Positive Technologies. So unless you’re in the other 7%, your organization’s security system can fail sooner or later, compromising operations and the safety and integrity of critical data.
Disruptions can also be an unpleasant experience for your customers. Even the shortest of service interruptions, let alone prolonged downtime, can make your customers shy away. If you want to prevent service lags, minimize downtime, and avoid both data and customer loss, an effective data backup strategy is a must-have.
Building a strategy for data backup means thinking about the workflows required to support production continuity in your organization, even in the event of a global disruption. An ICT provider like BTC Network can’t afford any downtime. With a complex IT infrastructure that includes 14 physical servers and 100 virtual machines across 7 locations in 4 countries, its backup strategy relies on NAKIVO’s solution to maintain strict SLAs.
Enterprise Backup Strategy: Key Points
Before building a backup strategy, you need to clearly understand what you need to protect and what resources you have for this. Before you start, you need to answer these questions :
- What data and systems should be backed up?
- What are your organization’s recovery objectives?
- What backup storage are you planning on using?
- Which threats are relevant to your organization’s data and infrastructure?
- How to boost backup administration efficacy?
At first glance, answering these questions may seem like a walk in the park. But trust us, it’s not as easy as you think. Each question is a step towards understanding your organization’s specific infrastructure priorities, requirements, and available resources.
Below, I describe how to create a backup strategy for mid-size and larger companies based on the answers to the questions above. But before I proceed, it’s important to note that the strategy will differ significantly depending on the size and needs of your organization. For example, larger companies typically have more data to protect with zero tolerance for downtime. They can also afford larger budgets to implement a multilayered approach to data protection.
1. Identify backup requirements.
Even though we’ve all heard about the importance of an effective backup strategy, many organizations are still a far cry from it. Almost 90% of organizations back up their data, and 76% still suffer data breaches and loss.
Backup requirements should be your first step. This corresponds to the first three questions in the list.
So first, identify which system in your IT environment has the least tolerance for data loss and downtime. Here, we usually focus on the machines with critical data stored on them or those machines with critical applications. The priority level of certain data types can indicate how their loss affects operations and business continuity. Figure out the types and priority levels of data across the environment. The structure you get indicates the desired backup frequency for a specific data category.
While it’s easy to identify where your most sensitive data is stored and how to prioritize it, there are less obvious things to consider. Here are a few tips:
- Map relations between different machines to know how they are connected and determine your priorities. Why is it important? Let’s say you use Microsoft Active Directory. In case of a disruption, you need to recover the machine with the domain controller first because other computers and applications are using Active Directory for authentication. This machine may not store any critical data per se, though.
- Know your system components and hardware limitations. One of our customers had a Windows file server with fake RAID enabled. SATA disks attached to the “RAID1” were the cheapest green disks. The overall reliability of such a system was low. When a RAID array failed and its status changed to “degraded”, there was no disk with the actual data to rebuild the array from. As a result, some data for the preceding few days was lost for good. Fortunately, this data was later collected from other computers.
After that failure, the customer invested in a real hardware RAID controller and hard disk drives of server class adapted to work in RAID (these disks have the error recovery control parameter that is limited to avoid abnormal behavior in case of read\write error). The backup strategy improved too: data was regularly backed up to another server running on Linux.
Once you have defined the importance of each data type and system component, determined system interconnections and prioritized elements, you can set your recovery objectives:
- Recovery time objective (RTO) is about the longest downtime your organization can tolerate.
- Recovery point objective (RPO) defines the maximum amount of data the organization can lose since the last recoverable backup creation.
I wish I could say that you can set recovery goals and then forget about them. Unfortunately, this is not how it works. Not only do you need to determine objectives for each machine individually, but also to test them regularly and adjust if needed. You can set an RTO of 3 minutes in your recovery plan, but if you cannot achieve that, the objective is useless.
Modern backup solutions allow you to improve RTOs and RPOs, so by choosing appropriate software, you can achieve tighter objectives. For example, one of the customers of NAKIVO, Backup & Replication, One World Direct, mentioned in their case studies, managed to improve VM recovery speed by 12 times (a Hyper-V VM recovery on the same host was under 5 minutes) by switching to the solution installed on a NAS server.
2. Choose storage for backups
Now that you know the priority and sequence of your data backups and determined recovery objectives for all machines, you need to determine which backup storage to use. Or better to ask: how many backup storage types can you use at once?
An effective backup strategy is impossible without the 3-2-1 backup rule. Simply put, you need to have at least 3 copies of your backup data stored on at least 2 different storage media, with 1 copy stored offsite. There are variations of this rule, according to which you should also have at least 1 copy stored offline and at least 1 copy of your data should be verified and error-free.
Let’s now explore the most common storage options and their advantages:
- Backup storage devices. You can use different platforms and devices to keep backups, such as local or USB disks, network-attached storage (NAS), CIFS/NFS network shares, tape and cloud. The recoverability and accessibility, as well as the budget required for storage capacity and maintenance, vary between storage types.
Cloud is an attractive and a storage type to store backups offsite (you remember that one copy of your data should be stored offsite, right?) There are some storage plans in the cloud presuming the low speed and low price, but there’s a catch. When you copy large amounts of data from the cloud backup, the price for data transfers can be high with some vendors, so you may end up spending more than expected.
You can also consider using tape to store backups (this way you’ll have your backup data both offsite and offline). Tape is often considered the cheapest storage option, but in our experience, this is not always true. In some regions and countries, the price for tape cartridges can be high, so it may be more rational to use hard disk drives.
- Backup storage location. You can store backups on-premises or send them offsite (including cloud storage or tape media).
- The benefits of local backup storage are complete control, enhanced security and the fastest recovery possible. However, on-premises storage platforms have more chances of getting damaged or destroyed in a disaster that hits your primary data center (for example, a data center flood), leaving you without the recovery tools.
- Storing backups remotely is more secure but recovery can be slower, as the speed will depend on the connectivity and other factors.
In my experience, the most common combinations are using local (onsite) backups with remote backups offsite (on servers with hard disk drives) or in the cloud. I usually recommend customers store primary backups onsite (for faster recovery), send weekly backup copies to secondary storage, and store monthly copies offsite, be it in the cloud or on tape.
3. Understand the threats
Analyze the specifics of your organization to find out which threats are more relevant in your case. This will help you fine-tune strategies for multiple disaster scenarios.
Typically, data loss can happen due to:
- Ransomware
- Hardware failure
- Software disruption
- Power outage
- Natural disaster
- Human error
Organizations reasonably concentrate on external threats such as ransomware infiltration. But the risk coming from the inside of an organization is not lower: 95% of data breaches happen due to human error.
Cybercriminals often use employees’ inattentiveness to infect data. For example, I can remember when a customer had an employee who opened a phishing email and infected his OneDrive with ransomware (if you think that phishing is an outdated strategy, check the stats: almost 40% of breaches involved phishing in 2021). OneDrive was set up on the employee’s computer as a volume, and it had files that were shared with other employees. As a result, ransomware spread across the company, and most of the files in OneDrive were corrupted.
4. Ensure backup administration effectiveness
First things first, you need to invest in staff training, including incident response, cybersecurity and ransomware awareness, etc. Your IT teams should have comprehensive checklists for different disaster scenarios with clear steps they need to perform and responsible people they need to contact with. Without this, administration efforts will never be as effective as you expect.
To improve the efficiency of administration, you should automate as many workflows as possible to reduce the amount of work and mistakes that people have to do. An efficient and automated administration process can save a lot of money in the long term.
Here are the 3 areas you must focus on, when doing data backup:
- Backup schedule. Plan and adjust the schedule, considering the specifics of your workflows and infrastructure. Modern solutions can enable any backup frequency you need without job overlaps that cause performance degradation due to CPU, memory or network overload.
- Backup automation. This helps reduce human error, avoid protection gaps and free up your IT department’s time for other core tasks.
Important Tip: Make sure to keep an eye on logs, back up job status, and set up automatic alerts for success, errors, failure, etc. There are situations when companies automate backup jobs without checking if the job was successful or not. As a result, when the data on the primary server is corrupted, there is no backup to recover from.
- Automated testing. Regular testing should be an integral part of your strategy. You need to ensure that your backups are recoverable and established recovery objectives can be met. While automatic backup verification is usually offered by the majority of modern backup solutions, disaster recovery testing can be a daunting task. We recommend simulating different disaster scenarios in a test mode, without disrupting the production environment. For this, opt for backup solutions where this feature is available and automated.
Use the testing data to ensure that your needs meet your capabilities. Make adjustments and implement new elements and technologies when necessary to keep the wanted level of data protection.
5. Calculate the needed budget
Before I write anything in this section, a quick reminder: the total backup system cost is never as high as that of the data loss that might occur.
The amount of funds you’ll need to spend on the backup strategy includes not only the backup solution and infrastructure that you require right away but also the investments in the system upgrades, expanding storage needs and more. It doesn’t mean that your backup strategy will take a heavy toll on your budget, though. Based on your recovery objectives, available infrastructure, data threats, and other criteria we discussed above, you can make an informed decision about where you can cut the budget and where you can not.
A tip. In case you are on a shoestring budget, consider backup and disaster recovery outsourcing, also known as backup/disaster recovery as a service (BaaS/DRaaS). This way, you will reduce data protection costs and offload the administrative burden. However, as you grant third-party vendors access to your data, you need to consider possible risks, such as a lack of security and vendor lock-in.
Conclusion
The only way to protect data and get it back after it gets lost is to have a reliable plan for backing it up. To build a backup plan that can increase the resilience of your organization’s IT infrastructure, you need to:
- Study the threats typical for your organization’s profile
- Shape your backup requirements
- Pick the suitable backup storage
- Automate backup workflows
- Set up regular backup testing
- Ensure effective backup administration
- Account the budget scrupulously
Choose a reliable vendor with a solution that suits your needs. Most of the time, vendors are willing to help you integrate their solutions into your infrastructure and carry out your strategy. You can order a personal demo, a free installation session, download a free trial or take part in beta testing to ensure that software has all the features you require.
Why is FinancesOnline free?
Leave a comment!