Backup Strategy for a Non-Profit

[Lalato]

Hello everyone,
I've been asked to help the local rape recovery center update their backup solution. They're a small non-profit and can't spend a lot of money, but they do realize the need for good backups of their data.

Currently their backup solution is via tape drive attached to their single server (Windows SB Server 2003). They do not currently have any offsite storage of backups.

I, myself, am a neophyte when it comes to backups so I thought I would post a question here to perhaps get some ideas on what a good solution would be. As you can imagine, they have some fairly sensitive information... and it would be a real shame if this community resource lost it due to a fire or other event.

Basically, the only device that needs to be backed up is the server. What would be a good place to start for researching options? Is the tape backup sufficient?

Thanks!
--sam

 

[claykin]

What type of data needs to be backed up? user data? SQL database data? Exchange? Tell us more.

 

[Lalato]

Sorry for the lack of details...

• User data currently resides on the server as all users have their "My Documents" folder redirected to the server. Some users have local data on their workstations, but that data could be synced or backed up to the server, I think.
• Server is running Exchange. So there would be a need to back that data up.
• Server has a custom database that would need to be backed up as well. I believe it's an Access database... not SQLServer.

Just in case it's important, there are only 11 workstations in the center. All are Windows XP desktops.

Thanks again for any advice you can give.
--sam

 

[Lalato]

As long as I'm asking questions. Is it best to have physical offsite backups, meaning that someone takes the backups home. Or is it better to have an internet based solution for keeping a copy offsite?

Thanks for any info you can give.

--sam

 

[thiggins]

Taking physical backups offsite depends on people reliably performing their assigned duties (properly dismounting / mounting drives and taking them off site). Costs include the backup drives and paying the person doing the backup duties.

Internet backup (to the "cloud") is completely automated. Costs are the monthly storage charge and perhaps data bandwidth. Cloud backup also can take days to complete the first backup, depending on how much you are backing up and the uplink speed of your Internet connection. Subsequent backups are faster, because only the changed files are backed up.

 

[Lalato]

Thanks for the great info, Tim.

Any thoughts on my original questions?

--sam

 

[thiggins]

You are asking primarily a process, not a technology question. There is already backup being done.

First step is to check that everything that needs to be backed up, is being backed up to the tape. If not, then the backup routine or software doing the backup needs to be changed.

Second, you need to look at the approach. Are they rotating tapes daily, weekly? What archives do they keep and for how long? You need to protect against corrupted backups and lost files. Multiple backup copies are the key.

Third, how often are the backups checked? Corrupted backups that can't be recovered are useless. You need to put a process in place to verify the backed-up data.

Depending on the size of the data being backed up, you could probably switch from a tape drive to a few inexpensive USB drives. This would probably speed up the backup process significantly.

Given the nature of the data, offsite backup should definitely be done. However, given the nature of the data, you might be limited in how it can be handled. You should check with the Center's director to see if they are under HIPAA restrictions. At any rate, if backups can be physically stored offsite, it must be at a trusted and secure site, approved by the Center's management.

 

[Lalato]

You bring up some excellent points that I will now go and research. Thanks once again.

--sam

 

[claykin]

To further Tim's excellent discussion of offsite (cloud) backup, take a look @ Jungledisk. This is the best offiste backup solution I've found and I've tested many (too many). Reliable, scalable, and with lots of features such as delta file copy and de-duplication. You hold the encryption keys and they can NEVER read your data (provided you setup correctly).

 

[Lalato]

Thanks for the tip, claykin. Much appreciated.

 

[kamina]

Some excellent points where made. To further what Thiggins said, you need to know why you are backing up. Generally the main requirements are either compliency or disaster recovery. Compliency should be fairly simple once you know what is required, disaster recovery can be more complicated. It's easy to recover from hardware failure (note what was said about testing the backups), but the difficult part is figuring out what else you need to be able to recover from. Is it possible an employee deletes or modifies an important file? How soon would it be noticed? Know how far back you need to be able to go, what will happen if you loose the last days worth of data? What about the last week, month? This should help you decide how often you will take backups, and maybe how long you need to store the data.

For most stuff I work with I recommend storing it for a month, taking incremental backups daily and full backups weekly. For slightly more important things a separate monthly backup could be made which is stored longer. I also recommend offsite backups in case of burglary or fire. The thing is, all this requires work, and you might be able to relax a lot on most of this...

However from your explanation I'm just as worried by access to the data. Not just backups of it, but also where it's stored and how it's accessed. Sounds like some interesting challanges, good luck and let us know if you need more help.