Another one which causes more issues than you might expect is providing the backups with sufficient security. I have seen numerous instances where there was no protection of backups aside from being stored in a warehouse. This includes storing unencrypted customer account and password data!
It makes it very easy for attackers - okay, they need to go back to physical attack, but this is a relatively straightforward way to get past all those technical controls that might exist on the live environment.
Best practices for backup are still applicable for small businesses:
Provide the appropriate level of encryption around backups
- Encrypt everything? easy but time
- Just encrypt sensitive data? you need
to then work out what data
Don't backup data which should not be backed up
Test incremental and major backups regularly
Test gold builds and snapshots (these count as backups too)
Physical security is also essential
- Locked premises
- Fire safes
- Fire extinguishers
- Who controls your backups?
- Can you trust them to get them backl to you on a timely basis as required?