Taking risks with data

Ann Keefe at Kingston Technology argues that too many companies are playing data backup roulette

Data loss or data inaccessibility comes in many forms. It could be due to a malicious attack, it could be a power failure, or it could be human error, but either way the impact can be devastating for businesses. While the average cost of a data breach is growing year by year, it also opens companies up to legal ramifications and in many cases, reputational harm.

While none of this is new, it’s surprising how many companies still leave themselves vulnerable to the risk of data loss. According to the 2021 Data Risk Report from Varonis, one-third of the folders used within a company were accessible by everyone and only 5% of folders were protected. 

Added to that, a poll conducted by Harris on behalf of Backblaze in 2022 found that while computer owners are conducting a backup more often than they did 10 years ago, only 10% of the 2065 people they spoke to conducted a backup daily, while 20% did it monthly and a further 20% had never backed up their data.

Backing up is a topical issue right now because March 31st marked World Backup Day, an annual event designed to raise awareness about the importance of regularly backing up digital data. The founders of World Backup Day were responding to a post on Reddit from a user who had lost his hard drive and wished someone had reminded him of the importance of backing up data.

Clearly, far too many individuals and companies are still failing to adequately back up their critical information. It’s hard to understand why such a relatively simple procedure is not hardwired into organisational protocols and systems, but this negligence is putting organisations unnecessarily at risk.

Causes of backup negligence

Let’s look at some of the reasons that companies have cited for data loss incidents.

Human error: In cases where data backups are performed manually rather than automatically, people often forget to do them consistently. With so many competing priorities, and so much data on the move, backups can simply slide. 

Cost and limited resources: Properly implementing data backup systems and protocols requires allocating sufficient budget, staffing, storage capacity, and other resources. For smaller companies or those prioritising other tasks, backup systems may not get adequate resources.  

Head in the sand: Some companies may be overconfident that critical data loss won’t happen to them. Despite well-publicised data loss events, they assume their primary storage systems won’t fail or be compromised and pay too little attention to the potential impact of losing data.

Outdated legacy systems: Companies still using older storage infrastructure may struggle to properly integrate it with newer backup solutions. Legacy systems can create backup challenges.  

Poor planning and processes: Often there is simply a lack of defined policies, responsibilities and processes for ensuring frequent, comprehensive data backups occur like clockwork.

Inadequate security: According to a report from Fastly last November, 29% of organisations cited data loss as the most common damage caused by a security breach. The need for secure storage of data is essential. 

How to stop backup falling through the cracks

Data backup should be viewed as part of data security measures, and automated backups scheduled on a platform that allows for timely changes. This requires a detailed, up-to-date list of the systems, data files and folders that need to be backed up. Decisions will need to be made about the frequency of backups, depending on the company’s own needs. 

There are multiple ways to back up data from cloud storage and online backup services through to optical media and USB flash drives. Each has its place and using a combination can help to create security against data loss.

One word of warning, however, cloud backups can also be impacted by security breaches, which can lead to cloud services, and therefore critical data, being rendered inaccessible until services are restored. 

External encrypted SSDs as a backup means having access to terabytes of gated, air-gapped data that is fully accessible to users, but inaccessible to cyber criminals.  In the event of an attack, or damage to systems, this type of backup drive, which is not connected to the internet, can be used to revert to files and folders from the last backup date.   

We would also recommend a 3-2-1 strategy which allows for almost every eventuality:

1. Keep three copies of the data – the original and an additional two copies.

2. Use different drives and do not store multiple backups on just one drive.

3. Keep one copy offsite so, in the event of a critical event such as fire or flooding, which could destroy one or both active backups, a third will still be available.

With so much at stake, companies are playing a very dangerous game if they do not make frequent, comprehensive data backups an absolute top priority. Annual awareness days can only do so much, but the importance of data backup cannot be underestimated.

When a company suffers a totally preventable data catastrophe, indifference and negligence will be difficult to use as an excuse.

Ann Keefe is Regional Director – UK and Ireland at Kingston Technology 

Main image courtesy of iStockPhoto.com and gorodenkoff