IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 6.32 Regular data backup
Initiation responsibility: Head of IT Section, IT Security management
Implementation responsibility: Administrator, IT users
To avoid irretrievable losses of data, regular backups must be made. In most
computer systems this can be largely automated. Procedures must be defined
as to what data is saved by whom at what intervals. Development of a data
backup policy is recommended.
Depending on the volume and importance of the data generated and with due
regard to the possible damage in case of loss of such data, the following must
be specified:
- Intervals
Examples daily, weekly, monthly (depending on the data quantities).
- Time
Examples at night, on Friday evening.
- Number of generations to be kept
Example: in case of daily full backup, the last seven backups will be kept,
as well as the Friday evening backups of the past two months.
- Extent of data to be saved
The simplest approach is to define partitions or directories to be covered by
regular data backup; appropriate differentiation can make it easier to obtain
an overview and help to save effort and cost.
Example: self-made files and individual configuration files.
- Data media
Examples tapes, cartridges, floppy disks, mirroring on 2nd hard disk.
- Prior wiping of data media prior to reuse (tapes, cassettes).
- Implementation responsibility (Administrator, user).
- Responsibility for monitoring the backup activities, especially in the case
of automatic backup (error messages, remaining storage capacity of data
media).
- Documentation on backups (date, type of backup procedure / selected
parameters; labelling of data media).
In view of the large amount of time and effort involved, it is generally
possible only to make one full backup per day, at the most. It is not possible to
restore the data generated after the last backup. For this reason and to reduce
costs, incremental backups, whereby only the data newly generated since the
last full backup is saved, should be made at regular intervals between full
backups. (If several incremental backups are made between two full backups,
it is also possible to back up only the data generated after the last incremental
backup.)
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Develop data backup
policy
Incremental backups