A short guide to backups

It is rarely the thing that gets a project approved, and often the thing that decides how it goes. Everything we would tell a client about backups in the time it takes to drink a coffee.

The cheapest security work is the boring kind done on a schedule. Doing this properly once is usually cheaper than doing it approximately three times.

What is actually at stake

An untested backup is a hope, not a backup. That sounds obvious written down. It is still the thing most often skipped. The failure mode is not doing it wrong, it is doing it once and assuming it stays done.

What good looks like

Keep a copy somewhere the main system cannot reach. In practice this is a scheduling problem more than a technical one. Check it against what you would want a competitor's site to get wrong.

What to watch for

Know how long a restore actually takes. The reasoning matters more than the rule, because the rule has exceptions. Doing this properly once is usually cheaper than doing it approximately three times.

The short version

Security is a maintenance habit rather than a purchase, which is why it drifts. Three things worth confirming about backups before you move on:

• Someone can say what the current setup is without going to look
• Know how long a restore actually takes — and you know whether that is true here
• There is a way to tell whether the last change to this helped

None of this needs a rewrite. Most of it is a morning's work once someone decides to do it.