A data backup (backup) is a copy of data, systems or configurations stored separately from the original so that it can be restored after loss, corruption, hardware failure or a cyberattack.
How backups work
Backups can be made at the level of files, databases, virtual machines or entire systems (images). The main types:
- Full – a complete copy of all selected data.
- Incremental – only changes since the last backup of any type; fast but needs the whole chain to restore.
- Differential – all changes since the last full backup.
Two metrics define a backup strategy: the recovery point objective (RPO) – how much data loss is acceptable – and the recovery time objective (RTO) – how quickly systems must be back. The widely used 3-2-1 rule recommends three copies of data on two different media, with one copy off-site; extended versions add one offline or immutable copy and zero errors in restore tests.
Why backups matter for security
Backups are the last line of defence against ransomware and wipers. Attackers know this: they delete Windows shadow copies, wipe backup servers and steal backup credentials before encrypting data – technique T1490 (Inhibit System Recovery) in MITRE ATT&CK. Backups that are permanently connected to the network, or accessible with the same domain admin account, are often destroyed along with production systems.
Backup best practices
- Keep at least one copy offline, air-gapped or immutable (object lock, WORM storage).
- Use separate credentials and MFA for backup systems, outside the main Active Directory.
- Encrypt backups and protect the encryption keys.
- Test restores regularly and include them in the incident response plan.
- Back up SaaS and cloud data too – providers do not always do it for you.
