On-Premise Backups Checklist

This is a quick checklist for making sure your on-premise backups are bullet-proof

Check #1: Backups should be encrypted

Check #2: Backups should be transmitted over an encrypted connection

Check #3: Backup process should be monitored for failure (backup process has an exit failure other than 0)

Check #4: Backup process should be monitored for not running (the backup process does not get triggered for some reason)

Check #5: Failed Backup Process should be notified via Slack messages, SMS, Ticket creation or email and preferably a combination of two or more.

Check #6: Backup should be stored outside current data-center

Check #7: Backup process should not consume all the network bandwidth but rather be bound to a max bandwidth or run on another network interface.

Check #8: Backup should have at least three copies else where.

Check #9: Backups restoration drills should take place monthly on production (this is were many people get it wrong)

Check #10: Backups should be taken for the following artifacts:

• Database Data
• Application Files
• Application Source Code
• Application Configurations
• OS Configurations (e.g. /etc directory)
• Virtual machine image
• Secret Keys

Check #11: Backup the Backup Software Tool you are using! Do NOT rely on the assumption that you can download it later since the download link might disappear or no longer be accessible.

Check #12: A Combination of incremental backups as well as full backups should be utilized wisely.

Check #13: Organization should agree on how much data can be tolerated to be lost if a backup is recovered (termed RPO Recovery Point Objective)

Check #14: Organization should agree on how time can be tolerated for the full-backup to be restored before data availability is back online (termed RTO Recovery Time Objective)

Check #15: Encryption Keys used for Backups should be accessible to different number of trusted & geographically distributed people (preferably more than five) in-case the death of any of them.

Check #16: Backups should have a Retention Policy defined. For example, a common retention policy used is as follows:

• Keep the last 7 days of backups
• Keep the last 6 weeks of backups
• Keep the last 12 months of backups

Check #17: Clearly document the Restoration Procedure for the backups and make sure all steps are clear and performed by an individual to make sure it works.