Backups

Backups

Backups are one of the most important defensive controls in
cybersecurity. A backup is a separate copy of data or system
information that can be used to restore information after loss,
corruption, accidental deletion, hardware failure, or a security
incident.

Strong backups can significantly reduce the impact of incidents such
as ransomware, accidental deletion, system failure, and destructive
malware.

1. What Is a Backup?

A backup is a copy of important data stored separately from the
original data so that it can be recovered when necessary.

Examples of information that organizations may back up include:

• Customer records.
• Financial information.
• Databases.
• Documents.
• Website files.
• Email data.
• Application configuration.
• Server configuration.
• Business records.

The objective is to maintain a reliable recovery path when the
original information becomes unavailable or untrustworthy.

2. Why Backups Matter in Cybersecurity

Backups are not only an IT convenience. They are an important part
of an organization’s security and resilience strategy.

Backups can help recover from:

• Ransomware.
• Malware infections.
• Accidental deletion.
• Hardware failure.
• Software errors.
• Database corruption.
• Human mistakes.
• Natural disasters.
• Unauthorized changes.
• Major system outages.

3. Backup vs Synchronization

Backup and synchronization are not the same thing.

Synchronization attempts to keep multiple locations updated with the
same current information. A backup is designed to provide a recoverable
historical copy.

If a malicious or accidental change is synchronized immediately to
another location, the second location may also contain the unwanted
change.

For this reason, organizations should maintain properly designed
backup copies rather than relying only on synchronization.

4. Full Backup

A full backup copies all selected data during the backup operation.

Advantages

• Simple recovery process.
• Complete copy of selected data.
• Easy to understand and manage.

Disadvantages

• Requires more storage space.
• Can take longer to complete.
• May consume more network resources.

5. Incremental Backup

An incremental backup stores changes made since the previous backup
operation.

For example, if a full backup is created on Sunday, Monday’s
incremental backup contains Monday’s changes. Tuesday’s incremental
backup contains changes made since Monday’s backup.

Advantages

• Uses less storage than repeated full backups.
• Usually completes faster.
• Efficient for frequent backup schedules.

Disadvantages

• Recovery may require multiple backup sets.
• Damage to a required backup set can complicate restoration.

6. Differential Backup

A differential backup stores changes made since the last full
backup.

For example, if a full backup is created on Sunday, Monday’s
differential contains Monday’s changes. Tuesday’s differential
contains changes made since Sunday’s full backup, including Monday’s
changes.

Advantages

• Usually requires fewer backup sets for recovery than incremental backups.
• Can provide a useful balance between storage and recovery speed.

Disadvantages

• Later differential backups can become larger.
• Uses more storage than incremental backups over time.

7. Comparing Backup Types

8. The 3-2-1 Backup Strategy

The 3-2-1 backup strategy is a widely used resilience principle.

It recommends maintaining:

• 3 copies of important data.
• 2 different storage media or storage types.
• 1 copy stored offsite.

The purpose is to reduce the possibility that one incident destroys
every available copy.

Modern environments may extend this principle with additional
controls such as immutable or offline copies.

9. Offline Backups

An offline backup is separated from normal network access.

Offline copies can be valuable during ransomware incidents because
malware that compromises connected systems may have a much harder
time modifying a properly isolated backup.

Offline backups must still be protected physically and managed
properly.

10. Immutable Backups

An immutable backup is designed so that stored backup data cannot be
altered or deleted during a defined protection period.

Immutability can provide additional protection against attackers
who attempt to destroy recovery data.

Organizations should still verify that their particular backup
technology and configuration actually enforce the intended
protection.

11. Offsite Backups

An offsite backup is stored at a different physical or logical
location from the primary environment.

Offsite storage can protect against incidents affecting an entire
location, such as:

• Fire.
• Flooding.
• Theft.
• Major hardware destruction.
• Regional outages.

12. Cloud Backups

Cloud-based backup services can provide scalable storage and
geographic separation.

However, cloud backups must still be secured properly.

Important considerations include:

• Strong authentication.
• Multi-factor authentication.
• Least-privilege access.
• Encryption.
• Retention settings.
• Account recovery procedures.
• Monitoring and audit logs.

13. Backup Frequency

Backup frequency determines how often data is copied.

Critical systems may require frequent backups, while less important
information may be backed up less frequently.

The correct schedule depends on how much data the organization can
afford to lose and how quickly services need to be restored.

14. Recovery Point Objective — RPO

Recovery Point Objective, commonly abbreviated as RPO, describes the
maximum acceptable amount of data loss measured in time.

For example, an organization with an RPO of one hour should design
its backup or replication strategy so that it can recover with no
more than approximately one hour of acceptable data loss.

A smaller RPO generally requires more frequent data protection.

15. Recovery Time Objective — RTO

Recovery Time Objective, commonly abbreviated as RTO, describes the
target amount of time within which a system or service should be
restored after disruption.

For example, a business may determine that a critical website should
have an RTO of four hours.

RTO influences the technologies, procedures, staffing, and resources
required for recovery.

16. RPO and RTO Example

Imagine an online business that processes customer orders.

• RPO: 30 minutes.
• RTO: 2 hours.

The organization should design its data protection strategy so that
it can tolerate approximately 30 minutes of acceptable data loss and
aim to restore the affected service within two hours.

17. Backup Retention

Retention defines how long backup copies are kept.

A retention policy should consider:

• Business requirements.
• Legal requirements.
• Regulatory requirements.
• Storage costs.
• Recovery requirements.
• Historical data requirements.

Keeping every backup forever may be expensive and may create
unnecessary data-management and security risks.

18. Backup Security

Backups contain valuable information and should therefore be treated
as sensitive assets.

Security controls should include:

• Access control.
• Strong authentication.
• Multi-factor authentication.
• Encryption where appropriate.
• Secure storage.
• Monitoring.
• Audit logging.
• Protected backup administration accounts.

19. Least Privilege for Backups

Only authorized users should be able to create, modify, delete, or
restore backups.

Backup administration should follow the principle of least privilege.
Users should receive only the permissions required to perform their
assigned responsibilities.

Separating backup administration from ordinary user accounts can also
reduce risk.

20. Encryption and Backups

Encryption can protect backup data from unauthorized access.

Organizations should consider protecting data both while it is being
transferred and while it is stored, depending on the backup
technology and threat model.

Encryption keys must also be protected. A backup that cannot be
decrypted during recovery may be unusable.

21. Backup Testing

One of the most common backup mistakes is assuming that a successful
backup job automatically means successful recovery.

Backups should be tested regularly.

Testing can include:

• Restoring individual files.
• Restoring databases.
• Restoring complete systems.
• Testing application dependencies.
• Checking backup integrity.
• Measuring recovery time.

A backup is valuable only when the organization can actually recover
from it.

22. Recovery Testing

Recovery testing should verify more than whether a file can be
copied back to a system.

Organizations should verify that restored systems are functional,
secure, and usable by the people and applications that depend on
them.

For example, restoring a database should also involve verifying that
the application can connect to the restored database correctly.

23. Backups and Ransomware

Ransomware can attempt to encrypt or destroy both primary data and
connected backup resources.

Organizations should therefore consider:

• Offline backup copies.
• Immutable backup storage.
• Separate backup administration accounts.
• Strong authentication.
• Restricted backup network access.
• Backup monitoring.
• Regular restoration testing.

24. Backup Monitoring

Backup operations should be monitored so that failures are detected
quickly.

Monitoring should identify issues such as:

• Failed backup jobs.
• Insufficient storage.
• Connectivity problems.
• Unexpected changes in backup size.
• Unauthorized backup deletion.
• Repeated restoration failures.

25. Backup Alerts

Organizations should configure alerts for important backup events.

Examples include:

• Critical backup failure.
• Backup destination unavailable.
• Backup retention unexpectedly changed.
• Large numbers of backup files deleted.
• Unauthorized administrative activity.

Backup alerts are especially important because a backup system can
appear healthy while silently failing to protect new information.

26. Database Backups

Databases often contain critical business information.

Database backup strategies should consider:

• Database size.
• Transaction volume.
• Recovery requirements.
• Consistency.
• Application dependencies.
• Backup frequency.

A database backup should be tested through an actual restoration
process where possible.

27. Website Backups

Websites may require multiple components to be backed up.

For a typical WordPress website, this can include:

• Database.
• WordPress files.
• Uploaded media.
• The active theme.
• Plugins.
• Important configuration information.

Backing up only website files without the database may not provide a
complete recovery solution.

28. Backup Documentation

Organizations should document their backup strategy.

Documentation can include:

• What is backed up.
• Backup frequency.
• Backup locations.
• Retention periods.
• Responsible personnel.
• Recovery procedures.
• RPO requirements.
• RTO requirements.
• Testing schedules.

29. Basic Backup Plan Example

Consider a small business website.

• Daily database backup.
• Weekly full website backup.
• Multiple retained recovery points.
• One protected offsite copy.
• Restricted backup administration.
• Monthly restoration test.
• Monitoring for failed backup jobs.

The exact configuration should be based on the organization’s
business requirements and risk assessment.

30. Defensive Backup Record Example

The following PHP example demonstrates how a backup event could be
recorded for monitoring purposes.

<?php

$backup_event = array(
    'type'       => 'backup_completed',
    'target'     => 'production-database',
    'completed'  => gmdate( 'c' ),
    'status'     => 'success',
);

error_log(
    wp_json_encode( $backup_event )
);

A production backup system would normally use a dedicated backup
platform or service rather than relying on a simple PHP logging
example.

31. Backup Recovery Workflow

1. Identify the recovery requirement.
2. Determine which backup version is appropriate.
3. Verify that the backup is trustworthy.
4. Prepare the recovery environment.
5. Restore the required data or system.
6. Validate the restored environment.
7. Apply required security updates.
8. Reconnect the system safely.
9. Monitor the restored system.
10. Document the recovery process.

32. Common Backup Mistakes

• Keeping all backups on the same system.
• Never testing restoration.
• Allowing everyone to access backups.
• Using weak backup credentials.
• Ignoring failed backup notifications.
• Keeping no offsite copy.
• Keeping no protected or isolated copy.
• Failing to document recovery procedures.
• Backing up data but not required system configuration.
• Assuming synchronization is a complete backup strategy.

33. Practical Lab

Scenario

A small organization stores customer records in a database and
operates an online website. The organization currently performs a
weekly backup but has never tested whether the backup can actually be
restored.

Your tasks

1. Identify the weaknesses in the organization’s backup strategy.
2. Recommend an appropriate backup frequency.
3. Design a basic 3-2-1 backup strategy.
4. Suggest appropriate backup access controls.
5. Define a reasonable RPO.
6. Define a reasonable RTO.
7. Create a restoration testing schedule.
8. List the events that should generate backup alerts.

Learning outcome

By completing this exercise, you should be able to design a basic
backup strategy that supports both cybersecurity and business
continuity.

34. Knowledge Check

1. What is a backup?
2. Why are backups important in cybersecurity?
3. What is the difference between a full and incremental backup?
4. What is a differential backup?
5. Explain the 3-2-1 backup strategy.
6. What does RPO mean?
7. What does RTO mean?
8. Why should backups be tested?
9. Why should backup systems use access control?
10. How can backups help during a ransomware incident?

35. Key Terms

• Backup: A recoverable copy of information.
• Full Backup: A backup containing all selected data.
• Incremental Backup: A backup containing changes since the previous backup.
• Differential Backup: A backup containing changes since the last full backup.
• RPO: Recovery Point Objective, representing acceptable data loss measured in time.
• RTO: Recovery Time Objective, representing the target restoration time.
• Retention: The period for which backups are kept.
• Immutable: Designed to prevent modification or deletion during a defined protection period.
• Offsite: Stored separately from the primary environment.

36. Summary

Backups provide organizations with a reliable way to recover data
and systems after accidental, technical, or security-related
disruptions.

A strong backup strategy should consider backup types, frequency,
retention, storage locations, security, access control, RPO, RTO,
monitoring, and restoration testing.

The 3-2-1 strategy, protected storage, offline or immutable copies,
and regular recovery testing can significantly improve resilience
against ransomware and other destructive incidents.

Most importantly, organizations should never assume that a backup is
usable simply because a backup job reports success. Recovery must be
tested and verified.

Next Lesson

Module 6 — Lesson 6: Access Control

In the next lesson, we will examine access control, authentication,
authorization, least privilege, role-based access, account
management, privileged accounts, and secure access practices.