Backups — Flashcards

1. Data volume — how much to back up
2. Backup type — full, incremental, snapshot
3. Media — tape, disk, cloud
4. Storage location — on-site, off-site, cloud
5. Software — backup and recovery tools
6. Schedule — hourly, daily, weekly, monthly

On-site: Same physical location; no WAN needed; fast restore; lower cost; vulnerable to site disasters (fire, flood).

Off-site: Geographically separate; requires WAN/internet to restore; slower; protects against site-level disasters.

Most organizations use both — on-site for fast everyday recovery, off-site for disaster protection.

The maximum acceptable amount of data loss following an incident, expressed as a time interval. RPO determines backup frequency: RPO of 1 hour → hourly backups; RPO of 24 hours → daily backups. If failure occurs just before a backup job runs, data changes since the last backup are lost. Lower RPO = more frequent backups = more storage and bandwidth consumed.

Backup media contains a complete copy of organizational data — highly attractive to attackers. If unencrypted media is stolen in transit, improperly disposed of, or accessed at an off-site facility, it constitutes a full data breach. Encryption ensures stolen media contains only unreadable ciphertext. Critical dependency: the recovery key must be stored separately from the media and must be accessible when needed.

A point-in-time copy of an entire system (VM, volume, or cloud resource) captured instantly. The initial snapshot is a full copy; subsequent snapshots are incremental (only changes since the previous snapshot). Example: Monday 100 GB full → Tuesday 40 GB changed → Wednesday 20 GB new. Fast to create, fast to revert, best used for VM and cloud infrastructure. Especially useful before major changes — revert in minutes if the change causes problems.

Backup jobs can complete successfully while producing corrupt or incomplete files. A "successful" backup log does not prove the data can be restored. Recovery testing requires actually restoring to a test environment and verifying that applications can use the data correctly. Discovering a corrupted backup during an actual disaster is too late. Periodic audits (weekly, monthly, quarterly) confirm the backup program is working.

Continuous near-real-time synchronization of data from a source to one or more remote destinations. Every change is propagated within seconds or minutes. Ideal for hot site DR — the replicated site always has current data. Critical limitation: replication propagates all changes including ransomware encryption and accidental deletions. Replication cannot replace periodic backups — periodic backups preserve historical recovery points that predate a data corruption event.

Replication propagates all changes in near-real-time — including ransomware encrypting files. Within minutes of infection, the replicated site receives and stores the encrypted files, overwriting the last good copies. Periodic backups are point-in-time snapshots that captured the data in a clean state before the ransomware struck — restoring from backup recovers the pre-infection data. This is why both replication and periodic backup are needed together.

A write-ahead logging technique that prevents storage corruption from interrupted write operations. Before writing to storage, the system records the intended change in a journal log. If power fails during the journal write → storage is untouched and clean. If power fails during the storage write → the journal entry allows the system to complete the operation automatically at next startup. Eliminates the need for backup restores caused by power-interruption corruption. Standard in modern file systems (NTFS, ext4) and databases.

Nothing was written to the actual storage target yet — storage remains in exactly the pre-write state, fully consistent. The incomplete journal entry is discarded at startup. No corruption occurred; no backup restore is needed. The only data "lost" is the in-flight operation that had not yet been committed — which was not yet visible to applications anyway. This is the safe failure mode of journaling.