Backup Strategies: Full, Incremental, Differential
Understand backup strategies, their advantages and disadvantages, and audit considerations for data protection.
Understanding Backup Strategies
Data backup is one of the most fundamental controls in IT operations. A proper backup strategy ensures that data can be recovered in the event of hardware failure, software corruption, human error, natural disasters, or cyberattacks. For IS auditors, evaluating the adequacy of an organization's backup strategy is essential because data loss can have severe financial, operational, and regulatory consequences.
Types of Backups
There are three primary backup types, each with distinct characteristics:
- Full Backup: A complete copy of all selected data. Full backups provide the simplest and fastest restoration because all data is contained in a single backup set. However, they require the most storage space and take the longest to complete. Organizations typically perform full backups on a weekly basis.
- Incremental Backup: Copies only the data that has changed since the last backup of any type (full or incremental). Incremental backups are fast to perform and require minimal storage. However, restoration requires the last full backup plus all subsequent incremental backups, making the restore process more complex and time-consuming.
- Differential Backup: Copies all data that has changed since the last full backup. Differential backups grow larger over time as more changes accumulate. Restoration requires only the last full backup plus the most recent differential backup, making recovery simpler than with incremental backups.
Backup Rotation Schemes
Common rotation schemes ensure that backup media are used efficiently and that multiple recovery points are available:
- Grandfather-Father-Son (GFS): A three-tier rotation using daily (son), weekly (father), and monthly (grandfather) backups. This scheme provides multiple recovery points across different timeframes.
- Tower of Hanoi: A more complex rotation that provides a greater number of recovery points using fewer media sets, though it is more difficult to manage.
Backup Storage and Protection
Backup media must be protected from the same threats as the primary data:
- Offsite Storage: Copies of critical backups should be stored at a geographically separate location to protect against site-level disasters.
- Encryption: Backup data should be encrypted, especially when stored offsite or transported, to prevent unauthorized access.
- Media Testing: Backup media should be periodically tested by performing trial restorations to verify data integrity and recoverability.
Audit Considerations
IS auditors should verify that the backup strategy aligns with the organization's RPO, that backups are performed according to schedule, and that backup logs are reviewed for errors. Auditors should test restoration procedures, verify offsite storage arrangements, and confirm that backup media are encrypted and properly secured.
CISA Exam Tips
For the CISA exam, understand the differences between full, incremental, and differential backups. Know that incremental backups are fastest to perform but slowest to restore, while differential backups offer a balance between backup speed and restoration simplicity. The GFS rotation scheme is the most commonly referenced on the exam. Remember that backups must be tested regularly to verify recoverability.