No business is safe from disruption or even outside cyber threats – no matter how small they are. Small businesses account for 43% of all cyber attacks, leading to financial losses and disruption. Data backups are one of the ways small businesses can protect their data from being lost or corrupted following a cyber attack or due to human error and system failures.
However, data backup isn’t as straightforward as you may think. Every business, small and large, needs a robust data backup strategy in place that matches their unique needs and keeps their data recoverable and protected.
Here are a few strategies you can deploy as part of your small business backup plan:
1. Create a Framework For Your Backup Strategy
Have you ever heard the expression “failing to plan is planning to fail”? You need to outline your objectives as part of a larger business continuity plan or disaster recovery plan. Start by determining your unique risks. What are the chances of a data-loss event occurring at your business? This includes cyber attacks, natural disasters, floods, fires, and other loss events. Next, what will the impact of one of those events be on business operations? Think carefully about the financial losses, loss of productivity, etc. How quickly do you need to restore normal operations to reduce the impact? Once you know the answers to those questions, you can determine your recovery time objective and recovery point objective.
Recovery Time Objective (RTO) is the maximum amount of time that an organization can tolerate being unable to access its data or systems before it starts to suffer significant losses, e.g., an organization with an RTO of 1 hour could not afford to have its email system down for more than an hour, or it would lose customers and revenue. Your RTO will guide your backup policy and how frequently data has to be backed up.
Recovery Point Objective (RPO) is the maximum amount of data loss that an organization can tolerate in the event of a disaster. For example, an organization with an RPO of 1 day could not afford to lose more than one day’s worth of data, or it would have to re-enter orders, invoices, and other important records.
These concepts can guide your backup strategy prior to deployment.
2. Keep Business Continuity in Mind
Lots of small businesses use file-sharing apps like Google Backup as their only cloud backup solution. These solutions replicate your data to a folder, but it’s not intended to get your business back up and running after a data loss event. For example, a simple data backup won’t help you restore your data if all of your applications and operating systems have been infected by a ransomware attack. You’ll need the right tools in place to recover data and systems quickly so you can get back to business.
A business continuity plan (BCP) is a document that outlines how an organization will continue to operate in the event of a disaster. It includes a detailed plan for how the organization will recover its critical functions, such as IT systems, communications, and physical facilities.
Make sure that your data backup tools and software can facilitate your BCP and minimize disruption.
3. Follow the 3-2-1 Principle
You might not need a very sophisticated backup solution, but you need one that protects your data in any disaster or loss event. Let’s say your small business backup strategy involves backing up your server to a mobile hard drive that is locked in your desk drawer every night. Sure, you’ll have a backup of your critical business data if the server fails or if there is a security incident, but what happens if there’s a fire in the building and the sprinklers and smoke destroy your hard drive? Or if it gets stolen? Unless you have another backup in a fireproof safe or off-site, you’ve just lost years of hard work and precious data.
The 3-2-1 principle is a little dated, but the concept is still sound. It requires having three versions of your data (the data on the original device/system and two others), using two different backup devices/media, and having at least one backup off-site. Keeping backup data at a secondary location means you can retrieve it when you need to.
Many small businesses have adopted a hybrid backup strategy, keeping some backups on site and some in the private or public cloud to protect their data against natural disasters or cyber-attacks.
4. Back-Up As Frequently As You Can
A successful backup strategy hinges on how often you back up. The more frequently you backup data, the less data you lose. If you back up data religiously at 8 a.m. and 4 p.m., and a loss event occurs at 3 p.m., you will have lost any work you’ve done between 8 and 3. Some businesses can manage that loss easily with minimal disruption; for others, it’s devastating.
Most security experts recommend that all businesses back up their data daily, but this can vary from one industry to the next. A healthcare or financial institution may want to back up their data every five minutes or perform continuous backups to ensure that patient or transaction data is completely protected at all times.
If necessary, set your backup goals and parameters for every department according to the nature of the data they handle. For example:
- Critical Data: Your transaction records, CRM records, and other critical data units should be backed up every 0-1 hour to avoid losing mission-critical information.
- Semi-Critical Data: Your file servers and customer chat logs should be backed up every 1-4 hours.
- Non-Critical, Important Data: Marketing and sales information can be backed up every 4 hours or twice a day if necessary.
- Semi-Important Data: Infrequently updated information like HR records can be updated once or twice a day.
These are just guidelines, however. Every business should decide what its loss tolerance is and how quickly data needs to be recovered.
5. Decide How Long To Retain Your Data
Once you’ve decided what to back up, how to back up your data, and plan the data recovery portion of your strategy, you have to consider how long you’re going to keep your backed-up data. This can depend on storage costs, the type of data you’re backing up, and any regulatory requirements your company has to adhere to. Backups take up a lot of storage space, which can be expensive, and they can become corrupted over time, which is why it’s a good idea to replace backups from time to time.
You may want to retain your local backups for around three months, daily backups for two weeks, and monthly backups until you delete your local backups. Retain your backups for as long as you can, within reason.
6. Secure Your Backups
Almost all ransomware attacks (93%) target your backups. If the malicious attackers carrying out the attack are successful, they could wipe out your ability to recover from the event, which can be devastating for small businesses. Make sure that your backup doesn’t allow inbound communication from an Internet connection. Deploy your backup devices in a secure LAN environment and limit outbound communications and permissions carefully to avoid falling victim to an attack.
It’s a good idea to keep your backup, computers, and networks separate as far as possible to prevent potential ransom- and malware attacks. Ransomware can lock cloud backups if systems are permanently connected and continuously backing up in real-time.
Small business backup strategies should also include a plan of action that imagines the worst-case scenario: your data backup ending up in the wrong hands. If that does happen, it’s important to prevent malicious actors from accessing your data. Always encrypt data in transit as well as at rest.
7. Avoid Backup Chain Dependencies
A backup chain is a sequence of backup files that are created over time. Each backup file depends on the previous backup file in the chain. This means that your backup strategy is vulnerable because you have created a single point of failure; if one file becomes corrupted or compromised, then all of the backup files that depend on it will be as well.
You can move away from this model by using a snapshot-based backup solution.
Snapshot-based backups create a point-in-time copy of the data, which means that each backup file is independent of the other backup files. This makes it less likely that a single backup file will cause all of the other backup files to be corrupted or deleted.
Alternatively, you can use a deduplicated backup solution. Deduplicated backup solutions store only the unique blocks of data in the backups. This can significantly reduce the amount of storage space that is needed for backups, and it can also make it less likely that a single backup file will cause all of the other backup files to be corrupted or deleted.
8. Test Your Backups – Especially After Integration
Having a data backup strategy in place is meaningless if your backup isn’t viable when a disaster occurs. Test your backups regularly to ensure that your data can be restored. If possible, look for solutions that offer automated validation and can alert you to any issues with your backup.
If you don’t have an adequate business continuity or disaster recovery solution in place, you may want to add additional backup components to execute your backup strategy, e.g., enabling virtualization, using your own private cloud solution, etc. Bear in mind that any mistakes or errors in the deployment will lead to recovery and backup problems. If possible, opt for an end-to-end, all-in-one backup solution to avoid errors.
9. Only Restore Data As Required
Restoring all of your data if one single important file or folder has disappeared is a waste of your time and resources. You should be able to perform file-level recovery for individual files/folders as well as rollbacks to your last recovery point in the event of a larger data loss. Look for flexibility from your backup vendors to avoid costly and intrusive data recovery processes. You need the ability to recover data as quickly and conveniently as possible.
10. Archive your data
Data archiving also has a role to play in crafting your backup strategy.
Data archiving is the process of storing data for long-term retention. Unlike a data backup, where data is typically stored for a shorter period of time and then used to restore data in the event of a disaster or other data loss event, archival data is stored for a longer period of time. You may or may not use archive data to restore data.
Data archiving will help your data backup efforts in several ways:
- Offloading older data from backup systems: Backup systems can become overloaded with data over time. Archiving older data can help to free up space on backup systems and improve performance.
- Reducing the cost of backups: Archiving older data can help to reduce the cost of backups by reducing the amount of data that needs to be backed up.
- Enhancing data security: Archiving data to a separate location can help to improve data security by reducing the risk of data loss or corruption.
- Meeting regulatory requirements: In some industries, there are regulations that require organizations to keep certain data for a specified period of time. Archiving data can help organizations to comply with these regulations.
- Providing historical data: Archival data can be used to provide historical data for analysis or reporting purposes.
If you’d like to know more about archiving data and data backups, get in touch with ShareArchiver. ShareArchiver is a comprehensive data management solution that simplifies data archiving and enables and optimizes your data backup strategy.
Final Thoughts
Buying a simple backup device or subscribing to a backup solution isn’t enough when you consider the complex threat landscape small businesses have to operate in. Make sure that you have a backup strategy in place that protects your data and can restore it if necessary.
Having a robust backup plan in place is the key to ensuring business continuity, compliance, and data security.
