Got backups? Mind if I see them?

Got backups? And can I see them? Questions you'll hopefully never hear from anyone besides IT support (and even then they can't actually see them).

Got backups? And can I see them? Questions you'll hopefully never hear from anyone besides IT support (and even then they can't actually see them). On a slightly more serious note, backup is one of the most important things you can be working on in a company. Because the day someone attacks you, breaches every firewall, password, and MFA prompt, the only thing that saves you is having data stored somewhere the attacker didn't reach.

So how should I be backing up?

You have several options. You can back up locally to a NAS. You can back up to the cloud, and you can not back up at all — but that's a road to hell (and the tax office). There's also the option of immutable backups — "undeletable" backups. Even the person who created them can't delete them, and unless the servers they sit on burn down, no one is wiping them. Backups can — and should — be combined; if you have the resources to back up both locally and to the cloud with some immutability, that's the best and recommended option.

Local backup

The main concerns for a local backup are security and damage prevention. Even with the best security you won't dodge a disk failure — and vice versa. For security, apply least privilege and never operate on the data under an admin account! For damage prevention, it's a good idea to run RAID, which mirrors data to additional disks and ensures that if one breaks, the data is still on another. Also stick to the 3-2-1 rule: 3 backups, on 2 devices, 1 off-site. That also helps you ride out events like floods, etc.

Cloud backup

Here the options are basically limitless. There are plenty of providers today, and if you have basic security practices in place, they're more secure than not.

In closing

The best thing you can do, as I said, is combine these two approaches and consider whether it's worth investing in immutability.