Most companies find out how good their backups are on the worst possible and lest expected day. Hardware fails, someone deletes the wrong folder, an attacker encrypts a file server – and it all comes down to the same question: is there a copy, is it recent, and does it restore?
That makes backups a core part of cybersecurity. They cannot stop an incident, but they decide how much of it a company has to live with.
What is a Backup?
A backup is a separate copy of data, applications, or system information kept for use in the event of data loss or corruption. The goal is to enable the restoration of a previous, functional state.
Backups are stored independently of the original data and - depending on the specific use case - can comprise individual files, databases, virtual systems, or entire IT environments. How often a backup runs decides how much work is lost when something goes wrong: a nightly backup means up to a day of changes are gone. That figure is called the recovery point objective (RPO); its counterpart, the recovery time objective (RTO), is how long a restore may take.
Key characteristics of a backup are:
- Storage of a copy of the original data
- Separation of production data and backup data
- Ability to restore a defined data state
- Retention for a specified period
How Does a Backup Work?
A backup creates a copy of selected data and stores it on a separate storage medium or in a different environment. This ensures that recovery remains possible even if the original data is no longer available.
The basic process typically involves the following steps:
- Decide which data and systems need backing up
- Copy the current data
- Store the copy separately from the original
- Keep several versions over a defined period
- Restore when needed – and test the restore before you need it
Not every backup copies everything for everybody. A full backup duplicates the whole dataset each time. An incremental backup saves only what has changed since the last backup of any kind: quick to write, slower to restore, because the restore has to walk the whole chain. A differential backup saves everything changed since the last full backup – more storage, but a restore in only two steps.
The Importance of Backups in Cybersecurity
Backups are a fundamental information security measure. They are not intended to prevent attacks, but rather to mitigate the consequences of data loss.
Backups are particularly important in the event of security incidents such as ransomware attacks, as well as hardware failures, misconfigurations, or accidental data deletion. Furthermore, they can help restore critical information following natural disasters or other forms of physical damage.
Ransomware deserves a note here, because the common picture of it is out of date. Attackers no longer simply encrypt and wait. They look for the backups first and destroy them, because a company that can restore does not pay ransom – and they copy the data out before encrypting anything, so that the threat becomes publication rather than loss. A backup protects availability. It does not protect confidentiality. And because it holds a complete copy of the company’s data, often with weaker access controls than the systems it copies, it is a target in its own right.
This is why immutable backups matter. They are protected against modification and deletion for a specified period. Consequently, even user accounts with elevated privileges or compromised administrator accounts cannot subsequently tamper with or remove the stored data.
Backup Rules for Data Protection
Various concepts have become established for the secure storage of backup copies. One of the best known is the 3-2-1 rule. It recommends:
- 3 total copies of the data
- 2 different storage media
- 1 copy at an off-site location
Building on this, the expanded 3-2-1-1-0 rule is frequently recommended today. It adds two further aspects to the concept:
- 1 immutable copy or one that is disconnected from the network
- 0 errors – verified by actually restoring, not by checking the backup file
The aim of these rules is to reduce the risk of all backup copies being compromised simultaneously due to technical failures, human error, or cyberattacks. In addition, backups should be regularly checked and tested to ensure that a functional backup copy is available in the event of a recovery.
The Role of Backups in Data Availability
Backups are not only good practice. Article 32(1)(c) GDPR requires the ability to restore the availability of personal data after an incident, and Article 32(1)(d) requires that such measures be tested – so an untested backup does not satisfy the provision, however reliably it runs. For essential and important entities, the NIS2 Directive names backup management and disaster recovery explicitly.
Backups are frequently confused with archiving. While backups are primarily intended for the restoration of current datasets, archiving aims to preserve information over the long term in an unaltered state - for instance, for legal or organizational reasons.
Nearly every business process now depends on digital information, which makes backups a baseline requirement in every IT environment. They limit the damage when something fails and restore access afterward – provided they are current, protected, and known to work.