Question

Discuss the issue of securing backups. There have been several incidents lately in which backup media containing personal customer information were lost or stolen. How should backup media be secured? What about off-site storage of backups?

Answer 1

Importance of securing backups cannot be underrated in today’s technological world. Despite all of the precautions you take, it is still possible that an insider can successfully attack your data. Therefore, it is important that you prepare for that possibility and enhance your resiliency by implementing secure backup and recovery processes.

Prevention of attacks on your data is the most important thing but experience says that people will still find a way to attack your data and make you and your organization vulnerable.

If a secure backup does not exist then it can lead to the following :

• Several hours of downtime to restore systems from loss of data
• Weeks of manual data entry when current backups are not available
• Months or years to reconstruct information for which no backup copies existed

Effective backup and recovery processes need to be in place and operational so that if compromises do occur business operations can be sustained with minimal interruption.

Policies for data security are a corporate concern and should be a fundamental element of an enterprise security strategy. To achievethis, a corporation should build a practice around five fundamental areas:

1. Assign accountability, responsibility and authority
2. Assess risk
3. Develop a data protection process
4. Communicate the process
5. Execute and test the process

Here are some best practices for storing backup offsite:

• Store materials within a reasonable distance for timely recovery. A radius of up to four hours is commonplace, but is subject to your business-defined recovery objectives and the threats you're protecting against.
• Keep all tapes, disks and other materials in a controlled environment safe from heat, humidity, dust, etc.
• Duplicate all onsite backup media (no single copies) and send them offsite daily
• Keep an inventory of all offsite materials
• Periodically test long-term retention media and migrate it to new media as technology evolves to ensure data recoverability