Alvaka Networks President and CEO, Oli Thordarson, recently answered some questions posed by John Edwards for a story he is writing for TechTarget. Oli’s personal thoughts and experiences are based on over 35 years working in the IT profession—and alongside other IT professionals—and provide valuable insight for Backup and Disaster Recovery Preparedness. Below is the Q&A…
What’s the biggest data backup challenge?
In my experience, ongoing discipline managing backups is the biggest challenge. It is common for many IT professionals to throw up the backup system and then get quickly sucked into the tyranny of the myriad of other challenges beckoning them in their IT management role. But backing data requires constant attention.
What makes this data backup challenge so daunting?
At regular intervals an IT pro needs to:
1. Constantly check the back-up error logs.
• If using separate media like tape, or other removable media, the media needs to be rotated out to a safe place.
• If using tape, the tapes need to be replaced periodically as they wear out.
• If using tape, the hardware needs to be cleaned periodically.
2. Even if the error logs say nothing is wrong, a periodic file restore should be performed to make sure it actually works. I have seen way too many occurrences of IT staff going through the motions for months (or years) of doing backups, only to arrive at the fateful day a recovery is needed and then find out the backups are not good or were never working properly.
3. Make sure the right stuff is getting backed up. Again, like the previous bullet, I have seen companies backing up for years and when they get to the day the need to recover, they find out they have not been backing up the right stuff. For a real-world example, I worked with a firm that added a new SQL Server and database, but the IT staff never modified the backup job to include the new database system. 18 months later, they had a major problem with the database and when they went to recover, they realized they never had a backup.
4. Make sure the backups are offsite. This has gotten easier with cloud technology, but this needs to be added to the process of making sure it is really happening. Again, test restore at regular intervals.
5. Ask the following questions:
• Are the Recovery Time Objective and Recovery Point Objective appropriate?
• Can RTO and RPO actually be realized in a recovery? Have you tested?
• Do RTO and RPO need to be updated given the current needs of the firm?
6. Secure backups!!! This is the most timely—and most often missed—new aspect of backing up in the wild west of the pandemic world, where the bad guys have gotten very adept at breaching networks, exfiltrating and encrypting the data, and then demanding ever-rising dollar value ransoms. So how does one secure backups?
• Air gap the backup from the network.
• Implement some sort of trusted insider methodology so that different credentials are required to manage the backups.
• Implement some sort of immutable backup, if possible.
• Don’t just throw backups into the cloud and think you are safe, especially if the backups are mapped network drives or don’t have completely separate credentials.
What’s the best way to address this data backup challenge?
There should be a complete review of the backup process every quarter, where the following questions are addressed:
1. Are the backup logs clean?
2. Are backups stored offsite?
3. Is the right stuff getting backed up?
4. Are RTO and RPO still meeting the company needs?
5. Are backup security practices up to snuff?
What’s the biggest data recovery challenge?
Making sure the IT staff can actually recover according to RTO and RPO.
What makes this data recovery challenge so daunting?
Testing RTO and RPO is not an easy fleeting task. Done right, it takes a lot of work. If hot sites are used to recover (especially if they are remote)…
1. It takes a significant maintenance window to test.
2. It requires involvement of user staff at the company.
3. It can be disruptive to company operations.
4. It is possible to temporarily break stuff in the process, causing the maintenance window to run long.
Careful planning, practice and refining of this process will make it faster, easier and more effective, as this best practice is evolved within the company.
What’s the best way to address this data recovery challenge?
This is an enormous challenge due to the time, money, expertise, disruption and risk involved with implementing and testing data recovery/business continuity processes. Executive support is a big plus if success is to be achieved.
Alvaka’s DRworx provides a state-of-the-art managed backup and disaster recovery solution. Working with your IT staff, we will implement the processes shared above to make sure your backups are there for you when you need them.
Smoke testing is a term used to describe the testing process for servers after patches are applied. 
Estimating an average time for patching servers and PCs can be a bit tricky. It can vary from one month to the next, depending upon the number and complexity of the patches released by your software vendors. You must consider all versions of operating systems and have a complete inventory of all your application software to do this job correctly. Our experience has shown that manual patching of systems takes on average of about 1.5 hours each.
This is a basic cost calculator for you to compute your typical monthly cost for patching your servers, PCs, laptops, tablets and associated application software. It also forms the basis for you to begin calculating your Return on Investment for software patching, or for comparison with alternatives to the manual process of patching operating systems and application software—such as Patch Management as a Service, also known as Vulnerability Management as a Service.