Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Recently my backup disk almost got full because of all the backups we keep: 30 days of daily backups for every database (mongodb). So, the more databases we have, the more space we need for backups.
Then I wondered if it is really necessary to have 30 backups of every database. Is there any security reason to keep more than 1? More than 2? Are there any security implications here?
I feel like random people on the internet are not going to be able to answer this for you. This is a business decision. How valuable is the data? What is the risk of loss / corruption vs the cost of more disk space? Imagine your worst disaster-recovery scenario, how far back would you need to go to get a clean snapshot? I certainly can't answer any of this for you.
You should ask within your organization what's the farthest back anybody has ever requested a backup. Then consider something like a ransomware attack. Say it happens Friday evening, will an admin notice before Monday (< 2 days)? How long will the recovery / cleanup take? Hours? Days? Weeks?
Can you think of other disaster scenarios? How long do those require your backups to run? I guess this answer really doesn't have much to do with security...
Mike Ounsworth answered this to an extent, but I will chime in here.
What are your requirements for backups? Do you need to follow any regulatory controls that have specifics? For example, HIPAA/HITECH had specific mandates for 2 years. If so, that is your final answer regardless of what anyone here can tell you.
As for full backups, is there a requirement for a full backup versus a differential? These are questions only your organization, and information technology/executives can answer, not anyone here. All we can do is speculate.
If I were unsure, it would mean I didn't have proper guidance, and my role wasn't clear. If this were the case, I would look at my industry to see what others are doing, and again, look to any regulatory requirements, as they have the final say.
