In this article, I\u2019ll pull back the curtain and explore how to make a business-savvy decision about cloud BDR. You may be surprised to find that by avoiding over-optimization (i.e., spending on \u201cnice to have\u201d features), you drastically reduce your cloud BDR costs while remaining resilient to disaster and cyberattacks. <\/p>\n\n\n\n
Before we start talking about solutions<\/em>, it\u2019s important to define our threat model. After all, we can\u2019t do any risk\/reward calculations without quantifying the risk. With cloud BDR, we\u2019re focused on the loss of original copies of data and local backups. <\/p>\n\n\n\n Today, there are plenty of threats a BDR strategy must account for, including: <\/p>\n\n\n\n Traditionally, businesses would use offline and offsite backups stored at a separate physical location(s) to address these threats. Today, cloud backups — when implemented securely (more on that in a bit) — provide a more affordable and agile storage mechanism. <\/p>\n\n\n\n At a basic level, a cloud BDR solution is pretty simple. You need the tooling to create backups and initiate recovery, and a cloud storage provider to host the backups. Of course, the details are what determine whether or not a given solution is viable. So, let\u2019s break down the key points to consider when comparing cloud BDR solutions. <\/p>\n\n\n\n From a data privacy perspective, encryption of data in transit and data at rest is a must. Encrypting data in transit helps to prevent eavesdropping and man-in-the-middle (MITM) attackers from reading data transmitted to and from the cloud. Similarly, encryption of data at rest helps ensure only you can decrypt and read your backup data even if the storage provider is compromised. Of course, the strength of encryption algorithms matters. Make sure to use secure, modern encryption like AES-256.<\/p>\n\n\n\n While <\/strong>it\u2019s okay to have a set of backups<\/em> on the same platform as your production workloads, make sure that it\u2019s not your only<\/em> cloud backup. The more you can spread your risk, the more likely your business will survive a catastrophic event. Therefore, you should always use a different cloud storage platform for production and disaster recovery. For example, if all your workloads are on AWS, backups in Azure allow you to get back up and running in the event your AWS infrastructure is compromised.<\/p>\n\n\n\n File sync is an excellent tool for convenience and collaboration. That\u2019s why tools like OneDrive and DropBox are so popular. However, file sync is also a great way for malware to proliferate across all sync\u2019d systems. For example, the infamous Virlock ransomware <\/a>used cloud sync to spread throughout networks. Because our goal is \u201coffline\u201d cloud backups, file sync is a non-starter.<\/p>\n\n\n\n Of <\/strong>course, technically, <\/em>\u201coffline\u201d cloud is an oxymoron. However, for practical purposes, cloud backups can meet the business requirements of an offline backup. Offline cloud backups simply need to be logically isolated from the rest of your infrastructure. That means cloud backups should be protected by strict security policies. Additionally, offline cloud backups should NOT be on the same security domains as production workloads, SSO (single-sign-on) shouldn\u2019t enable access to your backups, and the APIs and user interfaces used for production shouldn\u2019t have access to your offline backups.<\/p>\n\n\n\n MFA (multi-factor authentication) is simply a must for cloud backups in the 2020s. Compromised accounts are one of the most frequent attack vectors hackers use, and MFA is one of the best ways to limit risk. Consider solutions without MFA a non-starter. <\/p>\n\n\n\n Access keys to your cloud storage account are analogous to root or admin accounts on a traditional system. If your keys are compromised, an attacker can gain admin-level access to your backups. Therefore, it\u2019s important to securely store your key pairs and follow best practices like not saving them in plaintext where other users can access them, and not hardcoding them in scripts.<\/p>\n\n\n\n Ransomware is one of the most prevailing threats to data security today. Modern backup solutions need features that help mitigate the risk of ransomware. For example, our own CryptoSafeGuard<\/a> If you can change your backups, so can malware that breaches your account or compromises cloud access key pairs. Cloud immutability is a cloud storage feature that creates independently tracked, immutable, and versioned backup files. Each version is individually tracked and cannot be actively deleted from cloud storage. Enabling cloud immutability not only has compliance benefits (e.g. for HIPAA and GDPR), it also helps limit the risk of malware infecting your backups.<\/p>\n\n\n\n In the event of a disaster, you can\u2019t be sure the same platforms and servers will be available for the restoration of your workloads. Support for backup from and restoration to \u201cany\u201d (cloud, bare metal, or virtual) platform is important. For example, BackupAssist ER<\/a> enables fast, simple, and complete recovery of Windows servers to any environment regardless of where the original backup was taken.<\/p>\n\n\n\n The business side of cloud BDR comes down to a balancing act between cost, recovery time objective (RTO), and recovery point objective (RPO)<\/a>. What mix of tools, storage, and processes maximize your business benefit? Every business will have a slightly different answer, so let\u2019s jump into figuring that out.<\/p>\n\n\n\n All else being equal, costs go up as your requirements for RTO and RPO get faster and more recent. On the most expensive end of the spectrum, you have \u201cinstant recovery\u201d that restores a very recent backup in minutes. There are DRaaS solutions that can and do provide that functionality, but it comes with a steep price premium. For many SMEs, a recovery time measured in minutes or hours from a recent backup using tooling like BackupAssist ER more than meets SLAs and makes more business sense. <\/p>\n\n\n\n Let\u2019s take a closer look at RPO and RTO in the context of cloud BDR to understand why. <\/p>\n\n\n\n Your RPO will dictate how frequently you need to create backups and influence how many backups you need to store. Because cloud storage costs can add up fast, efficiency in where and how you store your backups can make a big difference. <\/p>\n\n\n\n From a backup perspective, you\u2019ll need to have: <\/p>\n\n\n\n Once you find the backup frequency that meets your RPO requirements, you\u2019ll need to pick a cloud storage platform. This choice can have a big influence on your backup costs. In addition to more backups requiring more storage space, you\u2019re often billed for egress data when downloading your backups. Even for SMBs, these costs can add up fast. Azure Blob Storage and AWS S3 buckets (both of which BackupAssist ER supports) are popular choices, but Wasabi object storage is proving to be a game-changer for many SMEs. Wasabi<\/a> costs 80% less than AWS and does not charge for data egress. <\/p>\n\n\n\n Additionally, how<\/em> your backup tooling creates backups will have a huge impact on how much storage you pay for. BackupAssist ER\u2019s compression and deduplication features<\/strong> go a long way here and typically reduce storage requirements by 50%-75%. <\/strong> <\/p>\n\n\n\n The ideal RTO is, of course, zero seconds. That\u2019s why the promise of DRaaS solutions that deliver \u201cinstant recovery\u201d is so alluring. It\u2019s also the only notable functional difference between DRaaS and tools like BackupAssist ER. However, with BackupAssist ER features like VM Instant Boot, RTOs measured in minutes or hours are achievable. While the exact amount of time for recovery will vary depending on variables like backup size and network speed, recovery with BackupAssist ER can meet the RTO requirements of many businesses at a fraction of the cost of DRaaS instant recovery. <\/p>\n\n\n\n In practice, that means SMEs are faced with this choice: Is \u201cinstant recovery\u201d worth ~80% of your BDR budget? <\/strong> <\/p>\n\n\n\n If not, the business case for DRaaS is no longer compelling. <\/p>\n\n\n\n Backup and disaster recovery (BDR) strategies are ultimately all about risk\/reward. We\u2019d all love RPOs and RTOs measured in milliseconds, but like anything else, there\u2019s a point of diminishing returns. With cloud BDR, a wrong choice in tooling or storage platform can get expensive fast. <\/p>\n\n\n\n With many DRaaS products, businesses can get reliable backups with instant recovery to address their BDR requirements. However, the cost of those solutions is often unreasonably high unless you need instant recovery. Worded differently: if you can meet your SLAs with recovery times measured in minutes to hours, the additional cost of DRaaS simply isn\u2019t worth it. <\/strong> <\/p>\n\n\n\n Sure, in some industries, seconds matter when it comes to RTO, and spending thousands to make sure you can recover as quickly as possible makes sense. However, for most SMEs, choosing a cloud BDR solution like BackupAssist ER that enables fast, reliable, and secure recovery \u2013 and investing those thousands of dollars elsewhere in your organization \u2013 is the right move. <\/strong> <\/p>\n\n\n\n For a practical example of how you can simply <\/strong>and affordably <\/strong>implement cloud BDR, check out the BackupAssist + Wasabi Joint Webinar<\/a>. There, you\u2019ll learn: <\/p>\n\n\n\nImportant considerations for a cloud BDR solution <\/h2>\n\n\n\n
#1 Encryption of data at rest and data in transit<\/h3>\n\n\n\n
#2 Use a different storage platform for offline backups<\/h3>\n\n\n\n
#3 Don\u2019t use file sync for offline backups<\/h3>\n\n\n\n
#4 Logically isolate \u201coffline\u201d cloud backups<\/h3>\n\n\n\n
#5 Multi-factor authentication<\/h3>\n\n\n\n
#6 Protect your access key pairs<\/h3>\n\n\n\n
#7 Ransomware protection<\/h3>\n\n\n\n
proactively prevents ransomware-infected files from being backed up. <\/p>\n\n\n\n#8 Cloud immutability<\/h3>\n\n\n\n
#9 Full recovery<\/h3>\n\n\n\n
#10 Balancing cost, RTO, and RPO<\/h3>\n\n\n\n
Managing costs, RTO, and RPO in the cloud <\/h2>\n\n\n\n
RPO considerations for cloud BDR <\/h3>\n\n\n\n
RTO considerations for cloud BDR <\/h3>\n\n\n\n
Final thoughts: Finding a balanced cloud BDR solution <\/h2>\n\n\n\n
BackupAssist + Wasabi: 100% of the cyber resilience at 20% of the cost <\/h3>\n\n\n\n