Essential Tips for Effective Backup and Recovery Testing

In the current age of Information Technology, not a day goes by without another frightening news article about a new and worse cyber, ransomware, or malware attack. Cybersecurity experts and hackers play an endless game of cat and mouse with new attack vectors being discovered and then closed. One of the oldest and easiest defenses against catastrophic damage caused by hackers, internal mistakes, or even unexpected disasters is the good old backup of important data and environments. However, if you are counting on your backups to facilitate business continuity when faced with a malware attack or sudden data loss, the process doesn’t end with active backups. Your backup process needs one more additional checkpoint – a solid backup and recovery testing plan. Read on as we examine the what, why, and how of backup and recovery testing with pointers for your recoverability tests, so that your backups truly are your organization’s safety net.

Questions about Backup and Recovery Testing?

Speak with our Compliance expert

What is Backup and Recovery Testing?

As per the definition, “A backup and recovery test is the process of assessing the effectiveness of an organization’s software and methods of replicating data for security and its ability to reliably retrieve that data should the need arise. ”

In a nutshell, backup and recovery testing is the testing of your backup systems such that you verify their recoverability when faced with real-world data loss scenarios. Backup and recovery testing is the cornerstone of your Business Continuity and Disaster Recovery plan (BCDR).

Why Test Your Backups?

When we look at the history of data backup from punch cards, to tape to HDD and now to the cloud, we see how backup technology has changed tremendously. However, the principle remains the same – anything that is important to the running of the organization should be backed up. The frequency of the backup (daily, weekly, etc.) and the type of backup (onsite, offsite, cloud, full or incremental) is then determined, and backups are activated. All safe and secure?

There is a misconception that having a successfully implemented and running backup process means they are protected from hackers or disasters. Unless you regularly check the backups, you can never be sure of a successful restore when you need one. The recovery could fail for a myriad of reasons, but just one is enough for you to experience a corporate disaster. We run through a few pertinent reasons why backup and recovery testing is essential.

#1 Because Backups and Restores Can and Do Fail Due To…

Hardware incompatibilities or faults wherein the backup looks like it was successfully written, but no device is able to read it. This was very prevalent with tape drives.
Mismatch of encryption/decryption keys.
Bugs in the backup software causing specific files or directories not to be restorable.
The backup process is not updated for changes in the IT environment. Example: New systems or companies have been added but not included in the backup.
My favorite: A malicious individual cleared the backup flag on all the files of a work colleague. As this individual knew that the company kept backups for 12 months, he waited a full year knowing that no backup existed for his colleague. After a year he deleted all his colleague’s files and then left the company. The colleague’s files could not be restored as they had not been backed up for more than 12 months.

#2 To Be Able to Recover from Malware/Ransomware

Consider this, you have exhaustively backed up your data. Ransomware/Malware strikes. You go to your last resort – your backup – to recover your data. BUT, you realize it will take you months to actually do a full restore of your petabytes of data. OR the digital key to decrypt your offsite backups was stored on local storage and is now in the vile grip of the ransomware/malware.

As Fabian Wosar, chief technology officer at Emsisoft, says, “In a lot of cases, companies do have backups, but they never actually tried to restore their network from backups before, so they have no idea how long it’s going to take.”

So please remember – it is excellent that you have a backup policy, but without regular testing of the backups, you are not protected from cyber, ransomware, malware attacks, or disasters.

#3 For Compliance Reasons

Backup and recovery testing is also a must for compliance reasons. The ISO-27001 Information Security standard states, as one of its mandatory controls to protect against loss of data:

A.12.2.1 – Backup copies of information, software, and system images shall be taken and tested regularly in accordance with as agreed backup policy

Backup and Recovery Testing Plan: 5 Pointers for Your Recoverability Tests

A few pointers for your your Recoverability Tests:

The obvious – start with a full-system restore. Check that you have enough disk space or cloud storage to restore the entire backup. Compare the total storage utilization of the restore with the backup.
Don’t skimp on spot-checking. The most common requests to recover data will be for one-off mistakenly deleted files and folders or Contacts or Team artifacts. Test your backup solution’s search and filtering capabilities such as metadata and keyword search, granular artifact recovery, recovery of various types of files, etc. Compare the content and size of the restored files to the original files.
Offsite backups are recommended. And that includes keeping any restore applications or encryption keys offsite too.
Map your network dependencies and prioritize restoration of systems.
When verifying your database recovery, ensure that you are restoring it on a system with sufficient disk space/cloud storage and the appropriate database management system software installed. Apart from spot checks and macro tests, check that you can reconnect your apps to the restored database and that they sync fine.

Simplify Backup and Recovery Testing With Secure Cloud Backup

CloudAlly offers a secure and easy-to-use solution for the backup of all the popular SaaS applications – Microsoft 365, Google Workspace, Salesforce, Box, and Dropbox. Once the backup task is created, you can rest easy knowing that a daily backup is automated and if an unexpected issue is detected, you will receive an alert. Restoring the data is a simple 4-click operation. All data is encrypted both in transit and at rest. Essentially, all data is stored in industry-leading Amazon S3 storage. This is in keeping with security best practices to abstract backups by storing them offsite. Furthermore, CloudAlly Backup is stringently secure and meets the GDPR compliance standards. Take a look at our security credentials.

Start a Free 14-day Trial (10-min setup (honest!) | No credit card | All Features)