Which backup strategy is appropriate?
A good backup strategy starts with answering the following questions: Which data is really important for me and which less? Which systems do I need to be able to restore quickly in order to keep my business running?
For data backup, a good guideline is certainly the well-known 3-2-1 backup rule, 3 copies on 2 media, 1 of which is external. As long as the immutability of these backups can be ensured, you have already done a lot right.
This backup philosophy also applies to your data that is stored with a provider such as Microsoft or Google. You will be made aware of this, your responsibility, by the cloud providers in the small print.
We recommend a combination of short-term immutable storage of all your systems and long-term immutable storage of your data.
If you are able to restore your entire systems within a useful period of time, this forms the basis for high and continuous availability of your entire IT infrastructure. Experience shows, however, that this function only really makes sense with reasonably up-to-date systems, i.e. it brings you no additional benefit if you keep copies of entire systems for a long time, because the up-to-dateness of the systems contributes significantly to their usefulness.
With data, on the other hand, the situation is somewhat different. Whether you are legally obliged to keep your important data, business transactions or intellectual property for one year, ten years or even longer, or you simply want to make sure that if an employee leaves your company, he or she can damage you by deleting data that is not immediately noticed.
But what is the really important data? Everyone knows which data is REALLY important and which data is REALLY unimportant – unfortunately, the grey area in between is very large.
In the end, the most sensible thing to do is to back up everything except the really unimportant data.
A successful backup strategy also includes a recovery plan. In this way you ensure that all parties understand their role and can perform it in an emergency. The whole thing should not be a purely technical exercise and should be run as a simulation from time to time. This allows you to have a clear, “simple” path to recovery in an emergency. Because in an emergency you cannot think freely, you have to be able to stick to a simple emergency plan with simple structures.
Conclusion: The right backup strategy must be well-thought-out, automated, tested and yet as simple as possible so that it really works reliably in an emergency.
