1

Recently my backup disk almost got full because of all the backups we keep: 30 days of daily backups for every database (mongodb). So, the more databases we have, the more space we need for backups.

Then I wondered if it is really necessary to have 30 backups of every database. Is there any security reason to keep more than 1? More than 2? Are there any security implications here?

|improve this question|||||
  • 1)Are they personal (e.g. for a personal project) or corporate databases? 2)Do you keep the backups in different locations? – A. Darwin Mar 31 '16 at 18:40
  • I think it would be good to keep the last 3 backups on 2 separate storage devices. If you're concerned these devices might get compromised you can encrypt them. – xorist Mar 31 '16 at 18:45
  • 1
    @l1thal Why 3? Can you support where that number came from? – Mike Ounsworth Mar 31 '16 at 18:46
  • @MikeOunsworth That's just what I used to do whenever I worked for a business where we did backups manually. – xorist Mar 31 '16 at 18:50
11

I feel like random people on the internet are not going to be able to answer this for you. This is a business decision. How valuable is the data? What is the risk of loss / corruption vs the cost of more disk space? Imagine your worst disaster-recovery scenario, how far back would you need to go to get a clean snapshot? I certainly can't answer any of this for you.

You should ask within your organization what's the farthest back anybody has ever requested a backup. Then consider something like a ransomware attack. Say it happens Friday evening, will an admin notice before Monday (< 2 days)? How long will the recovery / cleanup take? Hours? Days? Weeks?

Can you think of other disaster scenarios? How long do those require your backups to run? I guess this answer really doesn't have much to do with security...

|improve this answer|||||
  • 1
    Plus, are the daily versions of the data required or helpful? If data corruption would not be caught for a couple days, being able to go back a few days will make it possible to recover a certain version of the data. – schroeder♦ Mar 31 '16 at 21:18
4

Mike Ounsworth answered this to an extent, but I will chime in here.

What are your requirements for backups? Do you need to follow any regulatory controls that have specifics? For example, HIPAA/HITECH had specific mandates for 2 years. If so, that is your final answer regardless of what anyone here can tell you.

As for full backups, is there a requirement for a full backup versus a differential? These are questions only your organization, and information technology/executives can answer, not anyone here. All we can do is speculate.

If I were unsure, it would mean I didn't have proper guidance, and my role wasn't clear. If this were the case, I would look at my industry to see what others are doing, and again, look to any regulatory requirements, as they have the final say.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.