“Backups Are Like Video Game Saves”: What Makes up a Secure Backup Concept?

Concerning the topic of backups, the same questions arise repeatedly. The top 5 include:

1. Are the backups secure?
2. Are all important aspects covered?
3. What would happen if everything failed: Is a backup needed for the backups?
4. Are recovery and restart working as planned?
5. Who actually needs access to it?

Backups in theory and practice

On the surface, backups are a simple topic. A snapshot is taken of a state in which everything was still working. If something no longer runs as it should later, it will be restored to working order and continued from there. Therefore, backups are comparable in principle to the “save game” button in a video game.

But reality often presents itself differently. Questions in terms of backups are usually not easy to answer. Even to the seemingly simple question: “Where should I store my backups?”, the answer is: “It depends.”

What is really important? The conditions range from protection goals such as integrity, authenticity and availability, the amount of storage available for backups, to the question of how quickly backups can be created or restored, and what downtime can be tolerated. The question of saving backups is simple, but in order to be able to give a meaningful answer, a number of follow-up questions about the overall concept still need to be answered. For some time now, the question has been asked repeatedly: How can one prevent that the backups are affected in the event of an attack on the internal network and, in the worst case, even made unusable?

Backups: Best Practices

So what should a useful and secure backup concept look like when seemingly simple questions are so difficult to answer?

This is exactly where SySS can help. We help our customers find their way through the jungle of questions and find the best solution for them. Unfortunately, we cannot go this route for them, but we can provide advice and assistance. Specific recommendations for action are often already possible after an inventory workshop.

In such a workshop, we address topics such as backup encryption and testing physical security requirements, among other things. The following questions are also addressed: Are the backups encrypted? If so, how? Where are the corresponding keys stored? Who needs and who currently has access to this key material? In an emergency: Who can access the backups, both physically and digitally?

Backups in the picture

Here is a small comparison that could nicely illustrate the topic of backups and make it a bit easier to understand:

“Backups are like video game saves.” When in doubt, always save if:

• difficult scenario is imminent (e.g. a boss fight; before a major change in the systems),
• after a milestone has been reached, or
• enough data has been changed to make a backup worthwhile (in case of doubt, it is recommended to save more frequently).

In all these and many other cases, our Technical Consulting department is happy to provide advice.

This is because the security of systems is an important issue which should not be underestimated. Having the option to activate protected backups after systems have been compromised in order to restore a secure status – in good conscience that they have not also been changed – is worth its weight in (a large amount of) gold in case of an emergency.

Contact us anytime at: anfrage(at)syss.de.