Cyber Security: Effective Backups

Gary Kneeland, consultant for Invensys Critical Infrastructure & Security Practice, offers tips for effective backups.

Minimize Downtime Through Effective Backups

Modern organizations put more and more emphasis on using computer solutions for day-to-day problems. Whether it is payroll, operating door controllers, or controlling turbine assemblies, all these systems rely on computer systems that have been configured to work in their specific environment. Because of these configuration differences, replacing one of these systems in the event of a failure is not as simple as buying a new one off the shelf. Reproducing a configuration of a system without good backups can take huge amounts of time, and also introduce errors into the system that were not originally there. In some cases, the time lost while these systems are being replaced can shut down a production line or power plant for extended periods of time, costing companies millions of dollars. All of these reasons and more are why effective backups are important for any computer system in an industrial environment.

Keep it simple

The first requirement for effective backups is to make them as simple as possible to execute. If the backup procedure for a system requires a technician to go to the machine, plug in a laptop, and manually execute a backup that takes 4 hours to complete, this not only wastes time, but could lead to human errors while performing the backup activities. There are many software suites available now that will automatically perform backups of other systems, either locally or to network drives, and are highly customizable in how these backups are performed. Using one of these software suites to automate the backup process can make them easier and more reliable.

Determine the frequency and types of backups to occur

The second requirement for effective backups is to identify what frequency backups need to occur at and what types of backups need to occur. To evaluate how often backups need to occur, you must first know how often changes are occurring on a system. A controller for an emergency fire protection system may not be used often, and backups every month or every quarter is sufficient; however, for a payroll system that is being changed on a daily basis, incremental backups every day would be more appropriate. Determining the frequency of backups will assure that backups are current and usable, but keep resource usage at a minimum and keep costs down.

Store backup files offsite

The third requirement for effective backups is to have offsite storage locations for the backup files. If a company has up-to-date backups, but they are all in the same building as the servers when a flood or fire occurs, they are of no use. Because most backup software solutions allow network backups, consider other locations on the company’s WAN that can house the backups more safely. Storing backups at a corporate location that is offsite from your industrial complex can save a company when large scale disasters strike, such as flood and fire.

Use a test system to ensure smooth recovery

Finally, once a company has backups created for their systems, they must test that they can actually recover from these backups. Using a test system to attempt and recover from these backups can ensure that when the time comes to use system backups, it goes smoothly. Creating and testing a disaster recovery plan can help make recovery as smooth and painless as possible, and with the help of good backups, can prevent extended downtime to a company’s critical infrastructure.