Are backups really secure?

Question

In many places a common practice is to connect in a backup drive at the end of the day and let the computer do an automatic backup in case of an emergency. I have been doing that for the past 2 years until the day I needed to use one came, my computer was infected with malware but as I booted up in linux and inserted my drive I found out that the entire drive was also infected because the previous day I had connected the drive to get a backup while I didn't know a virus was in the system.

What are the common practices to take backups regularly without fear that the previous ones might get destroyed by something in the system?

Answer 1

You can find many examples of backup rotation schemes, like here:

http://www.backupassist.com/education/bsg2.html

We keep (at work) backups for the last 30 days, but that wouldn't solve this problem. It could well be that we are infected for two months without noticing it. In that case: remove by hand or reinstall.

When you use VMs like Amazon EC2, you can use snapshots. For your server or desktop OS, you can make a snapshot or image (disk image on tape or harddisk) of the installation right after initial setup, and right after all configuration is done, but without data. Later you can go back to that image. I use this method for creating vms for local development and testing machines.

You need to test backups on a regular basis. Do they still work? Do they still backup what is needed? Has the situation changed with new servers or data drives so you need to add or remove them from the backup scheme? And have you ever tested if you can restore a backup successfully? That takes time and effort, and you may postpone that, but you need it you better have a good procedure.

Another tip is to use two different backup methods, like one with tape, another in the cloud or using another backup program. For my laptop I use Time Machine and Crashplan.

None of these tips can make it so that nothing ever will be lost.

Sometimes you (or a process) delete(s) a folder without noticing it, and years later you need something in it, and it is simply gone. Once I deleted a mail account in my mail app, not realizing that this deleted sent mails. It tooks several years before I found out, and it was lost. I've had several times that I deleted something on my laptop that I needed later, and sometimes the backups saved me, but not always.

On my desktop I use Crashplan, which can backup everything and can save different versions of documents. But do realize that such a service can go bankrupt and then your backups are lost. You can use this program for local backups, but it seems to be that local restores won't work when CP is offline. So when they go bankrupt the local backups are gone too! Still it's a great service I think.

Answer 2

Use a decent virus scanner. One that includes automatic software updates.

Backups are meant to protect your data assets in such a way that they can be used to restore data after a data loss event. You need other software to protect you from malware.

To circumvent the risk that a malicious program destroys the data on the backup medium, you should probably introduce separate backup media. For instance: One drive for every day of the (work) week. Like tape backups were used in the past.

A cloud storage service might also be an option, if you have Internet connectivity. Most (all?) services have an automatic synchronization function, so your data is always backed up, and many also have built-in file versioning (similar to version control systems).

Answer 3

Assessing how your backups routine should operate should go part-in-parcel with your TRA and BIA.

Many companies have moved away from tapes for a variety of reasons, but one thing they had going for them is that you always had an offline copy of your data. When the backup from the night before was complete, you'd change the tape and it was then inaccessible until that tape was plugged in again, and thus not subject to malicious attacks like viruses.

A lot of SysAdmins took notice after the HB Gary Attack where backups were deleted. Disk and cloud based solutions can still be accessed, and thus they are not great at mitigating viruses, hackers, etc.

I believe firmly that every backup routine should encompass an offline copy of the data. Backup to a NAS drive and then unplug it from the network and rotate two drives each week. The data might be stale by some standards, but at least you'll have something to work with.