Backup as a Service

Formulate according to business operation and risk control goals

• RTO/RPO: RTO (Recovery Time Objective): How long can the enterprise tolerate the downtime? ; RPO (Recovery Point Objective): how much data loss can be tolerated at most?

And classify data by importance

• Hot data vs cold data: cold data refers to the important but infrequently used data, which is not expected to be accessed within 30 days; hot data refers to the important and commonly used data, which is recently frequently accessed.

Confirm what needs to be backed up, and usually distinguish between full-computer backup and data backup.

• Full-system backup: pack up with the operating system and applications for backup
• Data backup: only back up data, such as backing up database files, C disk, and certain files of the file server.

After selecting the data, start to decide the backup method.

• Full backup: back up all the target data every time
• Incremental backup: back up the addition of the previous backup file
• Differential backup: back up the difference between the backup and the previous "full backup".

After the decision is made, where should the data be backed up?

• Local backup: the backup data is stored in the same computer, but when the local hard disk is damaged, neither the original data nor the backup data can be retrieved. Therefore, local backup is not suitable to be used as the main data backup method.
• Remote backup: to avoid the risk of simultaneous damage to the original data and the backup data, store the backup data on a different machine (it can be another computer or an external hard disk). For example, the server data in the company's computer room is backed up to the NAS in the computer room without leaving the intranet.
• Off-site Replication: For example, the server data in the computer room of the Taipei head office is backed up to the NAS in the computer room of the Taichung branch: a VPN is needed to connect the two networks.
• Cloud backup: Back up data in the local to the cloud, eliminating the off-site cost and complexity.

• 3-2-1 backup principle: 3 copies of backup data, 2 storage media (commonly two NAS or 1 cloud and 1 local), 1 copy off site (commonly backed up to the cloud or to the IDC computer room or branch office) 

Backup is to copy the data you want to protect, so that you have a backup file of the target data; replication is to copy the important IT system of the enterprise in different geographical locations (off-site) for backup, in case of emergency, IT systems can be switched for backup to maintain business operations and reduce the impact of disasters.

Before setting the backup frequency, three factors need to be considered: 1. How often data is updated; 2. RPO and RTO; 3. Storage space.
If the update frequency is low, but the backup frequency is set to be high, there will often be situations where backups are required without updating, resulting in a waste of backup space or resources; relatively, the data update frequency is high, but the backup frequency is low, there will be situations where backup updates version will be missed; when the data no longer changes, the data can be moved out of the scope of continuous dynamic backup.

Before formulating the retention period, you need to consider 1. Whether there is a need for review or re-examination of the data (version retrospective or audit requirements); 2. RPO; 3. Factors, such as the size of the backup space. If the data is no longer changed or there is no need for re-examination, then it is enough to maintain the latest backup. Only when you are not sure whether there is a need for review, it is suitable to set the retention period according to the available backup space.