Chapter 10 — Backups
Lesson map
Lesson 10 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["10.1 What is backed up"]
N2["10.2 Why separation matters"]
N3["10.3 Checking"]
N4["10.4 Restore tests"]
N5["Recovery time"]
N6["Retention and the backup box"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 What is backed up"]
N2["10.2 Why separation matters"]
N3["10.3 Checking"]
N4["10.4 Restore tests"]
N5["Recovery time"]
N6["Retention and the backup box"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX037"]
[Learning outcomes]
|
v
[10.1 What is backed up]
|
v
[10.2 Why separation matters]
|
v
[10.3 Checking]
|
v
[10.4 Restore tests]
|
v
[Recovery time]
|
v
[Retention and the backup box]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) explain backup types; (2) check backups; (3) test restores.
10.1 What is backed up
The file server holds client files and is backed up nightly to the network storage box, with a weekly copy to cloud storage. PCs store work on the file server, so they need little backing up. The weekly cloud copy protects against a problem that destroys the office, such as fire or theft. Because PCs store work on the file server, rebuilding a failed PC does not lose client files. Nadia confirms with staff that they save work to the server and not to their desktops.
10.2 Why separation matters
Ransomware can encrypt anything it can reach, including the backup box if it is mapped as a drive. The supplier sets the box so that backups are written by the backup software only, and the cloud copy keeps older versions that cannot be changed for thirty days. Without these settings, ransomware that reached a staff member's PC could also encrypt the backups, leaving nothing to restore. Thirty days of unchangeable versions gives the firm time to notice an attack and restore from before it began. Nadia checks with the supplier that the settings are in place.
10.3 Checking
Each morning, the backup software emails a report. Nadia sets up a rule to flag failures and checks the report weekly with the supplier. A failed backup that nobody notices is the same as no backup. Flagging failures means Nadia sees them the same day. The weekly check with the supplier also looks at backup size and duration, which can show problems before they cause failures. Each failure is recorded with its cause and fix. Nadia keeps the reports for three months, so patterns over time can be seen.
10.4 Restore tests
Once a month, she restores one folder to a test location and confirms the files open. CIS Controls v8 Control 11 includes testing recovery. A backup that has never been restored might not work when needed. Opening the files proves they can be read, not only that the job completed. A monthly test once found that a shared folder was missing from the backup job, and the supplier added it. Nadia records each test with the folder, date and result, and chooses a different folder each month.
Recovery time
Lena asks how long recovery would take. Nadia times a restore of a large client folder: forty minutes from the backup box, three hours from the cloud copy. Lena decides this is acceptable but asks that the most active folders are restored first in any real event.
This conversation turns backup from a technical task into a business decision, which is where it belongs.
The timings are written into the recovery plan, so in a real event everyone knows roughly how long each restore should take and can spot one that is going wrong.
Retention and the backup box
The firm must keep some records for several years. The supplier sets backup retention to match, keeping monthly copies for seven years in cloud storage, and Lena confirms the period with the firm's compliance adviser rather than guessing. The network storage box that holds the nightly backups is itself a computer with firmware and an admin page. Because it holds every copy of the firm's files, it is an attractive target. Its firmware is updated quarterly, its admin password is unique and stored in the password manager, and its admin page is reachable only from the supplier's management PC.
Worked example
A monthly test reveals that one shared folder was excluded from the backup job; the supplier adds it.
Synthetic case. Events are synthetic.
Errors and limits
A backup that has never been restored may not work.
Exercises
- EX037 — Ransomware risk. Why should backups not be mapped as drives on PCs? Rubric: 3 = ransomware can reach them;; 2 = risk;; 1 = vague;; 0 = none.
- EX038 — Immutable copy. What does keeping unchangeable versions for 30 days give? Rubric: 3 = recovery after ransomware;; 2 = safety;; 1 = vague;; 0 = none.
- EX039 — Test finding. What did the monthly restore test reveal? Rubric: 3 = excluded folder;; 2 = problem;; 1 = vague;; 0 = none.
- EX040 — Report check. How are backup failures noticed? Rubric: 3 = flagged report email and weekly review;; 2 = email;; 1 = vague;; 0 = none.
Synthesis
Separated backups, checked daily and restored monthly, make recovery possible.
Continue studying — chapter 10 of 18
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →