# What Is Backup? Why Is It Critical for Organisations? **URL:** https://securesys.com.tr/en/learning/backup-and-business-continuity/what-is-backup-and-why-it-matters ![What Is Backup? Why Is It Critical for Organisations?](/images/bilgi-merkezi/covers/cover-backup-01.webp) One of the greatest misconceptions in digital systems is the belief that data accessible today will also be accessible tomorrow. A server may be running. The database may look healthy. Files may sit on central storage. The organisation may use strong firewalls, EDR/XDR solutions and advanced access controls. But none of these on its own guarantees that the data will not be lost. A ransomware attack, an accidental deletion, a disk failure, a faulty software update, database corruption, a privileged user error, a compromised cloud account or a physical disaster can remove an organisation's access to its critical data within minutes. **Backup is therefore not merely an IT operation.** In modern organisations, backup is one of the core components of; - cyber security, - data security, - business continuity, - disaster recovery, - ransomware defence, - legal and regulatory compliance. It sits underneath all of them. Since ransomware attacks began targeting not only production systems but backup infrastructures directly, the classic understanding of backup has changed considerably. The basic question is no longer: **“Do we have a backup?”** That is not it. The real questions are these: #### Is our backup protected from the attacker? #### Can it be restored? #### How long does a restore take? #### When was the last restore test carried out? #### If the production environment is lost entirely, how quickly can the organisation resume operations? **These questions take us from the concept of backup into a broader area: business continuity and disaster recovery strategy.** #### What Is Backup? Backup is the process of creating a copy of the data or system components on a system in another environment so that they can be used again in the event of data loss. At its simplest: **Original data + a secure copy = the basic backup approach** But corporate backup is far broader than that. The assets that need backing up can include; - physical servers, - virtual servers, - databases, - file servers, - user files, - Active Directory, - Microsoft 365 environments, - email systems, - ERP applications, - CRM systems, - web applications, - application servers, - virtual machines, - container environments, - cloud workloads, - configuration files, - security appliance configurations, - critical logs, - NAS and storage systems. All of these can be in scope. A successful backup strategy therefore does not mean merely “copying files”. **It means making the critical digital assets the organisation needs in order to continue operating rebuildable.** ### Why Does Backup Matter So Much? Three fundamental security objectives are spoken of in an organisation's information systems: #### Confidentiality #### Integrity #### Availability **This trio is known in the information security world as the CIA triad.** Backup plays a critical role particularly in availability and integrity. Preventing data being read by an attacker matters. But the organisation being unable to reach its own data is also a serious security problem. If a financial institution's customer database is encrypted, for instance, operations can stop even though the attacker did not exfiltrate the data. If a manufacturing company's ERP system becomes unreachable; orders, stock management, production planning, shipping, invoicing and similar processes can be disrupted. Data loss is therefore not merely an IT problem. **It is directly a business continuity problem.** ### Data Loss Does Not Happen Only Through Cyber Attack When backup is mentioned today, one of the first threats that comes to mind is ransomware attacks. But data loss can have many different causes. #### Human Error One of the important causes of corporate data loss is user or system administrator error. An administrator can delete a critical folder by mistake, for instance. A database administrator can run the wrong SQL command. A virtual machine can be removed by accident. A user can save a faulty version over an important file. In incidents of this kind there is no attacker. But the result is the same: **The critical data cannot be reached.** #### Hardware Failure Disks, storage systems, RAID structures and other hardware do not run forever. Several disks failing at the same time, or a storage controller problem, can cause serious data loss. RAID technologies provide resilience against particular hardware failures, but RAID is not a backup. This distinction matters especially. #### RAID ≠ Backup RAID can help the system keep running. Backup lets you return to a healthy past version of lost or corrupted data. ### Why Does Ransomware Target Backup Systems? In modern ransomware operations the attackers' aim is not merely to encrypt files. **From the attacker's perspective, one of the most effective ways to raise the likelihood of payment is to remove the recovery options.** In advanced attacks, therefore, attackers first survey the organisation's infrastructure. Active Directory can be examined. Domain Administrator accounts can be compromised. Virtual infrastructures can be discovered. Backup servers can be found. Backup management accounts can be targeted. Snapshots can be deleted. Attempts can be made to reach backup repositories. Production systems can then be encrypted. The attacker's goal is clear: **To leave no clean copy the organisation can return to.** **In modern backup architectures, therefore, backups must not merely be created but isolated from attackers.** ### Are Backup and Snapshot the Same Thing? No. These two concepts are frequently confused. A snapshot records the state of a particular system or storage area at a particular moment, quickly. It is extremely useful in virtualization and storage environments in particular. But a snapshot is in most cases dependent on the source infrastructure. If the main storage system is lost, the snapshot can be lost too. A privileged attacker can delete snapshots. A snapshot therefore; **can be part of a backup strategy but is not a backup strategy on its own.** ### Replication Is Not Backup Another important misunderstanding is replication. Replication copies data to another system or location. For example: **Server A → Server B** real-time replication can be carried out in this form. This is extremely valuable for high availability. But if a file is deleted by mistake, that deletion can be replicated to the other system too. If ransomware encrypts the data, the encrypted data can be carried to the other system. Therefore: #### Replication ≠ Backup Replication increases availability. Backup lets you return to a healthy past state of the data. In well-designed corporate structures the two technologies complete one another. ### What Should a Corporate Backup Strategy Be? A successful backup strategy must answer three basic questions: #### What are we backing up? The organisation's critical assets must first be determined. Not every piece of data carries the same criticality. Losing a marketing presentation and losing the organisation's main customer database do not have the same impact. **Business Impact Analysis (BIA) work therefore matters.** #### How often are we backing up? Backup frequency must be determined by the rate at which the data changes. For some systems a daily backup can be enough. On some systems hourly backup can be required. On critical systems holding financial transactions, a far lower data loss tolerance can be needed. An important concept appears here: #### RPO – Recovery Point Objective RPO expresses the maximum data loss the organisation can accept. For example: **RPO = 24 hours** means the organisation theoretically accepts losing the data of the last 24 hours. But: **RPO = 15 minutes** means the backup and replication architecture must be designed accordingly. #### How quickly can we come back? The second critical concept: #### RTO – Recovery Time Objective RTO expresses how long a system must take to be brought back into working order after an interruption. For example: **RTO = 4 hours** means a critical system set at that target must be brought back within four hours. A backup strategy is therefore not measured by storage capacity alone. **Recovery time is also a core criterion of the architecture.** ### What Is the 3-2-1 Backup Rule? **One of the best-known principles of the backup world is the 3-2-1 backup rule.** The basic approach is as follows: #### 3 copies of the data #### 2 different storage media #### 1 copy in a different location The organisation's production data may sit on a storage system, for instance. The second copy can be kept on a local backup repository. The third copy can be stored in a different data centre or in the cloud. But with the development of ransomware attacks, the classic 3-2-1 approach has been extended too. **Today more advanced models such as the 3-2-1-1-0 backup strategy are used.** The additional approach there covers the use of immutable or offline copies and verified backups. We will handle this subject in detail in a later part of our series. ### What Is Immutable Backup? **One of the most important concepts of modern backup architecture is immutable backup — unchangeable backup.** Backup data created as immutable, for the defined retention period; - cannot be changed, - cannot be overwritten, - cannot be deleted by normal means. This approach provides critical protection particularly against ransomware attacks. Because even if the attacker reaches the backup management system, under particular conditions they cannot alter backups held as immutable. But there is an important detail here. A product stating that it “supports immutable backup” is not enough on its own. The architecture must be configured correctly. The authorisation model must be designed correctly. Backup management accounts must be separated from production accounts. MFA must be used. Retention policies must be applied correctly. Otherwise a powerful technology can be rendered ineffective by faulty configuration. ### What Is Air-Gap Backup? An air gap is the approach of separating the backup environment from production systems physically or logically. The aim is that even if the attacker compromises the production environment entirely, they cannot reach the backup system directly. The classic physical air-gap example is tape backup systems. Once the backup is complete the tape can be physically removed from the system. **In modern structures, logical air-gap solutions can be used.** The backup repository can be reachable only at particular times, for instance. Network segmentation can be applied. Separate identity management can be used. The backup network can be separated from the production network. These methods make it harder for the attacker to reach the backup system. ### Why Does Offsite Backup Matter? An organisation keeping all its backups in the same data centre is a significant risk. Because some events affect not only the server but the whole location. For example: - fire, - flood, - earthquake, - a power infrastructure problem, - physical sabotage, - a data centre outage can happen. At least one of the critical backup copies sitting in a different physical location therefore matters for business continuity. **This approach is called offsite backup.** Offsite backup can be held on; a second data centre, a cloud environment, a remote backup repository or physical media. Any of these can serve. ### What Is Cloud Backup? Cloud backup means backing up corporate data to storage environments in cloud infrastructure. Cloud backup can provide advantages such as; scalability, geographic redundancy, operational convenience, storing data in a remote location. These are its strengths. But “being in the cloud” does not automatically mean the backup is secure. In cloud backup environments too; identity security, MFA, encryption, privilege management, immutable storage, retention policy, logging, monitoring and restore testing carry critical importance. ### If We Use Microsoft 365, Do We Still Need Backup? This is one of the questions organisations ask most often. SaaS platforms such as Microsoft 365 offer high availability and infrastructure resilience. But using SaaS does not remove the organisation's data protection responsibility entirely. A user can delete data by mistake. A privileged account can be compromised. Files can be maliciously altered. In a data loss noticed long afterwards, the platform's standard retention period may not be enough. A separate backup strategy must therefore be assessed for critical SaaS data. Particularly on services such as; Exchange Online, SharePoint, OneDrive, Teams the organisation's data retention and recovery requirements must be analysed. ### Should Backup Files Be Encrypted? Yes. A backup mostly contains the whole of an organisation's most valuable data. Customer information, financial records, personnel information, trade secrets, databases, personal data can all sit in backup environments. The compromise of backup files can therefore turn into a serious data breach. Backup data must be protected with strong encryption mechanisms both in transit and at rest. In other words: #### Data in Transit + Data at Rest protection must be assessed together. ### Why Must Backup Management Accounts Be Separated? In modern ransomware attacks one of the most critical security principles is separating the backup infrastructure from the production environment as far as possible. A Domain Administrator account also being the full administrator of the backup system, for instance, can create serious risk. If the attacker compromises Active Directory they can reach the backup system too. In critical structures, therefore; separate administrator accounts, separate credential structures, MFA, privileged access management, network segmentation, the least privilege principle must be used. The aim is simple: **Compromise of the production environment must not mean automatic compromise of the backup environment.** ### If We Have Backup, Can We Say We Are Safe? No. A backup's real value emerges only when it can be restored. **In professional backup management, therefore, one of the most critical operations is the restore test.** Organisations looking only at backup job results is not enough. A “Backup Successful” message does not definitively guarantee that the data can be brought back successfully when needed. Real restore tests must be carried out at defined intervals. For example; a file, a database, a virtual machine, an application server, Active Directory components can be restored into a test environment. Whether the system genuinely works must then be verified. ### A Backup Without Restore Testing Is a Risk **One of the most dangerous states of backup systems is a false sense of security.** The dashboard may be green. The backup may complete every night. But at the moment of a real disaster it can emerge that; the backup file is corrupt, the required encryption key cannot be found, the restore takes longer than expected, the application does not open from the backup, dependent systems were not backed up. Any of these can surface. The success of a backup operation must therefore be measured not by: #### Was a backup taken? that question, but by #### Can the system genuinely be brought back? that one. ### The Difference Between Backup and Disaster Recovery Backup and disaster recovery (DR) are closely related but different concepts. Backup creates a copy of the data. Disaster recovery covers the technological and operational process needed for information systems to be run again after a disaster. Suppose a data centre becomes entirely unusable. Your backup data may exist. But; where will the new servers run? how will the network configuration be created? how will DNS be redirected? in which order will the applications be brought up? how will the databases be restored? how will users connect to the system? how will the security controls be brought into service? These questions are broader than backup. **They are assessed within the disaster recovery plan.** ### Business Continuity Is a Bigger Concept Than Backup Backup → protects the data. Disaster recovery → brings the technology back. Business continuity → keeps the business operating. These three concepts must be separated from one another. A bank bringing its information systems back may not be enough on its own, for instance. The environment in which staff can work, communication channels, customer services, critical suppliers, payment systems, operations teams must also be assessed within the process. **Business Continuity Management (BCM) is therefore a corporate management discipline beyond technology.** ### ISO 27001 and Backup From the perspective of the ISO/IEC 27001 information security management system, backup processes are one of the important control areas. Organisations must define; which data will be backed up, the backup frequency, the retention periods, the access privileges, backup security, the restore procedures, the testing processes. All of these must be set out. Backup processes being not merely implemented technically but managed with policy and procedure matters. ### ISO 22301 and Business Continuity **On the business continuity side, one of the important standards is ISO 22301 Business Continuity Management Systems.** ISO 22301 helps organisations determine their critical processes, analyse business impact, assess interruption scenarios and develop plans that let them keep operating. Backup is one of the important parts of that structure but not the whole of business continuity. In corporate structures, therefore; **Backup + Disaster Recovery + Business Continuity** must be assessed together. ### Why Does Backup Matter Under KVKK? Protecting personal data does not mean merely preventing unauthorised people reaching it. Data being stored securely, its integrity being preserved and appropriate technical/organisational measures being applied also matter. If personal data sits in backup environments; access privileges, encryption, retention periods, deletion policies, logging, physical security and similar controls must be assessed. The important point not to forget is this: **Personal data in a backup environment is still personal data.** The lifecycle in the backup environment of data deleted from the production system must be managed separately. ### What Should an Effective Corporate Backup Structure Contain? In a modern backup architecture, choosing backup software is not enough on its own. Organisations must assess the following areas together: - a critical data and system inventory, - data classification, - RPO targets, - RTO targets, - backup frequency, - retention periods, - 3-2-1 or a more advanced backup architecture, - immutable backup, - offsite backup, - the air-gap approach, - backup encryption, - MFA, - separate management accounts, - network segmentation, - backup monitoring, - restore testing, - a disaster recovery plan, - a business continuity plan, - documentation, - exercises. Each of these items forms a different layer of the backup strategy. ### The Biggest Mistake: Seeing Backup Merely as Storage A backup project must not be reduced to the question “how many TB of data will we back up?” The real question is this: **“If we lose all our systems tomorrow, how will we keep our business running?”** Once that question is asked, the subject stops being storage capacity alone. RPO, RTO, ransomware, immutable backup, air gap, offsite backup, disaster recovery, business continuity all become parts of the same architecture. ### Conclusion: Backup Is Not a File Copy but a Corporate Resilience Strategy Backup systems today are not technologies used merely to bring back accidentally deleted files. Modern backup infrastructure is one of the core parts of an organisation's cyber resilience. Because it may not always be possible to prevent a cyber attack. Hardware can always fail. An employee can make a mistake. A software update can produce unexpected results. A data centre can become unreachable. A strong security strategy therefore does not only ask: **“How do we prevent the attack?”** That is not the whole of it. It also asks: **“How do we bring our systems back despite everything?”** It prepares the answer to that question too. A well-designed backup architecture is the foundation of that answer. But backups existing is not enough on its own. Backups must be secure, isolated from attackers, restorable when needed and able to meet the RPO/RTO values the organisation targets. A backup strategy must therefore be designed with the perspective of; **backup + cyber security + disaster recovery + business continuity** working together.