© 2013 by Nick B. Nicholaou, all rights reserved President, Ministry Business Services, Inc. Reprinted from Christian Computing Magazine
I see this question in IT forums and get asked it a lot: What do you recommend for a backup strategy? The reason is that backup is one of every IT department’s highest responsibilities. In fact, a poor or untested backup strategy has caused more IT people to lose their job than any other single issue I’ve seen. So let’s look at the current state of backup best practices.
Backup Strategy
The strategy should be designed to accomplish the disaster recovery and business continuity goals set by an organization’s leadership in case a catastrophic event hits. So let’s start there.
Most organizations have not stated their goals in this area other than to communicate that the system must be backed up and available ASAP. What does that mean? And what does it cost? And what’s the difference between disaster recovery and business continuity?
Simply stated, disaster recovery is the ability to recover from a catastrophic event, while business continuity is the ability to continue to function through such an event. Some data and services are necessary to continue to do business while an event is ongoing. These usually include communications (voice and email systems) and database (ability to look people up, process payroll, etc). It probably is not necessary to have every document or graphic file available to continue to be viable during a prolonged crisis.
That said, leadership should be asked to prioritize the categories of data and services and then state the amount of downtime it considers acceptable during a prolonged event for each category. For instance, they may say that communications should not go down, database should be down for no more than four hours, and the rest must be backed up and available within four business days. That kind of statement should drive the backup strategy, and by categorizing and prioritizing data and services, can help keep the cost of an effective strategy minimal. Not stating recovery and continuity in those kind of terms is usually interpreted by IT that everything must be quickly recoverable, and that is a more expensive strategy to implement.
It is also important to point out that an untested backup strategy is, likely, a failed strategy. I’ve seen many times when good IT people have lost the trust of their leadership because a backup strategy failed when it was most needed– during a catastrophic event. This is an area where being too busy due to understaffing, etc does not work as a reason for not testing the strategy on a periodic basis. Plan to test a different aspect of your backup strategy every month; your team will thank you if it is ever put to a real-time test.
What Solutions Should We Use?
There are many backup solutions available to choose from, and understanding their strengths and weaknesses can help you customize your strategy to accomplish the goals set by leadership within a reasonable budget. If the budget is more than leadership is willing or able to fund, ask them to re-state the disaster recovery/ business continuity goals so you can adjust the strategy accordingly. Their job is to protect the organization and to give you guidance, and it’s okay to not get it right in the first pass.
Corporate America is still focused primarily on local tape backups. They are quickly available when a file or folder recovery is needed, and have large enough capacities to cover the full range of data that needs to be safeguarded. Most of our clients purchase LTO4 tape drives, which have 800gb native capacities. For those with larger needs, LTO5 and LTO6 are also available (1.5tb and 2.5tb native capacities, respectively). We recommend doing a full backup nightly, and taking one tape off-site weekly to protect against the loss of a building.
Some today believe that hard drives are better backup targets than tape, but their drawbacks are higher sensitivity to breakage/ failure and higher cost.
Backups require software to make them work, and the solution we have found to be the most capable and reliable is Symantec’s BackupExec. It requires more time and attention to keep running well than we’d like (it occasionally drops communication between the backup server and the source, or file server), but we haven’t found as reliable a solution yet to replace it that is also reasonable in cost.
What About Online Backups?
The abundance of online backup solutions has, more than anything else, added confusion to the backup strategy discussion. The concept sounds great, and like hard drives sounds like a leap forward in technology. However, it has a weakness that cannot be overlooked.
Consider, for example, the amount of bandwidth available at your organization. If there was an event which took out your servers, we could get something up and running in their place within hours. The next step would be to restore data and services. Given the amount of data you have backed up, how long would it take to download your online backup over your Internet connection? If yours is like most churches or ministries, it could easily take a month or more.
To be fair, some online backup organizations say they can send you a copy of your online backup on a tape or hard drive. We have not seen that successfully meet the expectations of IT or leadership. Online backup may be good as a consumer solution, but is not a good enterprise solution.