Member Avatar for rouxpepe

What is the best to keep the backup of sensitive enterprise data: "onsite or offsite"?

  • 3 Contributors
  • 2 Replies
  • 68 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by Major Major

Dani AI

Generated

asked a simple question with complex tradeoffs. and rightly focused on risk and budget; the practical answer is to design backups around data value, required recovery time/objectives, and regulatory constraints rather than pick “onsite” or “offsite” in isolation.

  • Map and classify data and set RTO/RPO for each class so protection matches business impact.
  • Use a resilient topology as a baseline (for example, the common 3-2-1 approach: multiple copies, multiple media types, at least one copy offsite). (3-2-1 backup rule)
  • Encrypt backups end-to-end and separate key management from stored data; prefer client-side or customer-managed keys and a hardened KMS/HSM. Follow established cryptographic guidance for authenticated encryption and key lifecycle. (OWASP cryptographic storage guidance)
  • Make backups tamper-resistant: immutable snapshots/object-lock, strict ACLs, dedicated backup accounts, and MFA for admin access.
  • Verify backups with automated checksums and scheduled full-restore drills; a backup that cannot be restored is worthless.
  • If budget is limited, tier protections: critical systems higher frequency and redundancy, archives lower cost and lower frequency.

Document the plan, keep an updated inventory and runbooks, and log chain-of-custody for any physical media. For formal recovery planning and media handling details, consult standard guidance such as and NIST SP 800-88 (media sanitization).

Recommended Answers

All 2 Replies

Member Avatar for TPHTA

The easy answer is that any enterprise class backup system should include offsite backup. If all your eggs are in one basket, you are leaving yourself open to failure when you need your backup.

For instance, at smaller companies, theft of the server usually includes all attached peripherals and any backups in the immediate vicinity.

Placing backups in a fire proof safe may not prevent your backup media from melting at temperatures easily reached within the safe (even a little warping from direct sunlight can render some media inoperable).

Then there are a multitude of other disasters, both natural and man-made that can ruin a company if they do not have data off-site.

Once you determine that you have to take sensitive data offsite, you must protect it from prying eyes while it is outside of your control. This even includes the transportation system used to deliver the data to the place of storage. Not long ago, a large company sent tapes for storage, only to have them misplaced by the carrier in shipment.

Transporting your data via an online service has several problems too. The biggest is that the transmit bandwidth of your Internet connection often limits the size of your backup as you do not wish to saturate the link during business hours. And then you have to worry about the security of the server that is always on the Internet. FYI, any backup service using FTP transmits your name and password in the clear over the Internet.

Now how do you protect the sensitive part? Well, the best answer is encryption.

In the end, only someone with knowledge of the data's sensitivity vs. the cost of it's loss can determine if data should be stored off-site. However, even for the smallest of businesses I always recommend doing so as no business can afford to loose data.

Member Avatar for Major Major

Unfortunately all of this boils down, all too often, to budget. TPHTA is correct in that no business can afford to lose all of it's data. The question is how much data loss is acceptable. This will determine much of the cost of your backup solution.

a monthly off-site backup solution will cost much much less than a weekly, or daily solution.

Without any additional information there is a limit to what recommendations can be made. The only way to tackle this is to ask questions which you have here at any rate. Come up with some cost estimates and threat and risk assessments how much will it cost to do X and what are the risks we take do the risks outweigh the benefits? Present them to someone with budget discretion. Pray that they don't just say whatever.

Most people see IT as a hole in the corporation that money disappears into never to be seen again. Show them what that money is doing and you'll have more success.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.