What to avoid when backing up data

By Muthoga Kioni

Backing up data is a major information security pillar. It forms an integral part of good business governance. Backing up data also ensures business continuity and disaster recovery.

One of the lessons learnt from the bombing of the US Embassy in August, 1998 was that businesses have to be prepared for disasters and a major fundamental of disaster preparedness is ensuring elaborate backup policies are in place.

Data backup policies in many companies are usually surmised into timelines on when backups are to be done. These policies usually ignore some aspects that ensure backups are secure and reliable.

One of the most often ignored principles concerns faulty computers. It is normal to have some desktop PCs or laptops failing. When these machines are not fixed in time they are often removed from the backup schedule. The result is that data that should have been backed up is missed and this results in a risk exposure to the business. An example would be a faulty laptop that contained personnel data that was never backed up even after repair. This critical data cannot then be pieced together if a disaster occurs.

Another failing is when backup tapes are recycled too early. When tapes are in short supply, it is common to find used tapes being recycled. This might contravene business and regulatory requirements and is as inexcusable as failing to backup the business data in the first place. Data growth is a perennial problem for businesses. This is where the data backup starts taking longer than usual due to the huge data that businesses are generating every month.

This means that backing up of systems that cannot be backed up until the normal business day has ended, is postponed until the end of the week. These back-ups are also conducted partially in the week so as to fulfill policy requirements.

Ignoring open files when backing up is another failure of most backup policies. The back up process skips or ignores any programs that are left open by users. Missing these files means that business’ critical data can be left out. This situation is made worse by the fact that it is often the business’ critical files that are consistently open and, therefore, unable to be backed-up.

We should therefore exercise extreme care when backing-up data, be it individual or business data, because the importance of this process will only come to the fore when a disaster occurs.

—The writer is an ICT Security and Forensic Specialist. Email: [email protected]