What methods should I use for backing up data?

Data is the lifeblood of your business. Losing it due to hardware failure, accidental deletion, or cyberattacks can have devastating consequences. How much would it cost you to have your entire business unable to work for a few hours? A few days? A month? How hard would it be to create a month or year’s worth of work?

Losing data due to a hardware failure, accidental deletion, or a cyberattack can be devastating. That's why data backup is crucial.

Key best practices for data backup:

1. Determine your backup needs

Before you start backing up your data, assess your specific needs. Consider factors such as:

• Data volume: How much data do you need to back up?
• Data sensitivity: How important is this data to your business?
• Regulatory requirements: Are there any industry-specific regulations that dictate your backup practices?
• Special Needs: Do you use SQL databases or other niche software that has specific backup practices that you need to consider in your overall strategy?

2. Choose a backup strategy

There are several backup strategies you can choose from:

• Full backups: Create complete copies of all your data.
• Differential backups: Back up only the files that have changed since the last full backup.
• Incremental backups: Back up only the files that have changed since the last backup of any kind.

A combination of full and incremental backups is often recommended for optimal efficiency and recovery. In addition, there is a newer set of options available in recent years

• File Based: In this case, the solution will back up only files on the device.
• Image Based: In this scenario, the software will take a snapshot of the entire computer saving all files, operating system, applications, and all system settings. The image can be downloaded, opened, and files extracted. Bare metal restores are possible using image files by using utilities to boot up the computer loading the image file and restoring the entirety of the computer.

Typically a company will do file-based backups on Workstations and then snapshot images of servers or high-value workstations (like CEO or Accounting personnel).

3. Select a backup solution

There are various backup solutions available, including:

• Local storage: Backup data to a physical device like an external hard drive or NAS (Network Attached Storage).
• Cloud storage: Store backups in a remote data center (AWS, Google, etc..)
• Hybrid storage: Combine local and cloud storage for a balanced approach (an approach I see most often).

Consider factors like cost, security, and accessibility when choosing a solution. How do you know what is best for you? The biggest determiner for you will be your risk tolerance. Consider that cloud-only storage might take a significant amount of time to restore as it could take several hours for the files to download from your provider. In a hybrid model, this downtime can be reduced by pulling data from a local source instead of from the internet.

4. Test your backups regularly

To ensure your backups are working as intended, perform regular tests. This involves restoring data from backups to verify their integrity and recoverability.

Typically, backups are tested quarterly using spare stations and or virtual machines. The goal of the tests is not just verification of the data, but of your restoration processes to get estimates on restoration times.

5. Store backups securely

Protect your backups from unauthorized access, accidental deletion, or physical damage. Consider storing backups in a secure location, both physically and digitally. 

6. Follow the 3-2-1 rule

A common backup rule is the 3-2-1 rule:

• 3 copies: Have three copies of your data.
• 2 media: Store copies on different types of media (e.g., hard drive, cloud).
• 1 off-site: Keep at least one copy off-site to protect against disasters.

7. Built-In Tools

Some of the more current operating systems contain built-in tools for some level of data protection.

• Windows / Microsoft Office: Includes One Drive which can be used to sync your desktop, documents, and even custom folders to
• Microsoft’s Office SaaS platform. They provide you with 30 days of protection and 90 days of deletion coverage.
• OSX (Apple): Provides their Time Machine solution. This is a local solution, not cloud-synced. But can offer rapid restoration of any damaged or lost files, even your entire computer.

RPO and RTO

Two important terms to keep in mind when planning your backup strategy. These two terms speak to your risk tolerance.

• RPO (Recovery Point Objective): The maximum acceptable time interval between when a data loss occurs and the point to which data can be recovered. In other words, it's the acceptable data loss window. For example, if you back up your computer on Monday nights, but you suffer a drive failure on Wednesday morning… the RPO is 1 day. You entered data on Tuesday, but since the system did not back up that night, the latest data set is from Monday. The recovery point objective for this customer in this scenario is 1 day. If you want an RPO of 12 hours, then you would need to set backups to run nightly to achieve that RPO.
• RTO (Recovery Time Objective): The maximum amount of time allowed to restore critical business functions after a data loss event. It's the target timeframe for getting your operations back online. Sometimes called the ETR (Estimated Time to Restore) this is the measure of time allowable downtime in a recovery event.

By establishing your RPO and RTO you can align a set of strategies to meet these goals and know how long it might take for you to restore normal business operations during a recovery event.

By following these steps, you can protect your data and minimize the impact of potential data loss events.