Backups

A backup is a digital copy of your important data, such as photos, documents, and financial records. If your data is lost, you can use your backup to restore it.

You can store backups using the cloud (which is like storing the data on the internet) or on physical media (such as external hard drives).

The data you back up should be determined by how important it is to you and the impact it would have if it was lost. 

Here are some guiding principles and tips to backing up your data to make sure it is secure, up-to-date and available when you need it.

Maintaining a regular backup routine can help ensure you have a safe and up-to-date copy of your files. Your routine might be hourly or daily, or maybe you only need to back up once a week or once a month. How often you make a backup depends on how frequently your data changes and how important that data is.

Automatic backups reduce the burden of backing up. If your data is automatically backing up, you won’t have to manually create a backup each time - your backup software will do it for you. This way, your backups will always be up to date.

It’s important that you regularly try to restore your backups to check that they are working properly. Testing whether you can restore your data will give you peace of mind that if you lose any data, your backup will work.

If your original data is lost, your backup may be your only chance to recover it. Securing your backup means that is safe from cyber threats and you can rely on it being available when you need it.

Your backup likely contains personal or sensitive information. It should be protected like any other copy of your data.

• Disconnect your backup when not in use Ideally, your backup media should only be connected when performing a backup. If your machine is infected by ransomware or malware it could spread to your connected media. By disconnecting your backup once it is finished you will greatly reduce the risk of your backup becoming infected. 
• Keep an offline backup. Keeping an offline backup will help you restore your data after a malware or ransomware attack. Ransomware and malware has been known to infect backup files by spreading to connected hard drives or cloud storage. An offline backup is a backup that is not connected to any devices or networks. With at least one backup kept offline at any given time, you will always have a backup available to restore from. One way to maintain an offline backup is to use multiple storage devices, such as hard drives. You can regularly swap over the hard drive that is being used to store your backup. This way, you always have a recent, offline backup available. For extra protection, store this offline backup in a different building or location. Note: Some cloud backup services won’t require an offline backup if they keep older versions of your data. These services will allow you to restore a previous version of data even if the backup was infected by ransomware or malware.
• Store your backup at an offsite location. Try to keep at least one backup in a different building or offsite location to your device so fire or theft won’t result in complete data loss. There are different ways to ensure you have a backup at an offsite location. These include swapping hard drives (as mentioned above) or using a cloud backup service. We recommend researching the solution that best fits your individual circumstances.

For example, Julie has two backup hard drives. One week she uses one of her backup drives and the next week she uses the other. She backs up at the end of each day, only keeping the drive plugged in while the backup is performed. The backup drive she is not using for the week is kept securely at her house.

• Physically protect your backup. Ensure all backup devices are stored in a secure location, such as a locked cabinet or drawer. This will help protect them from physical theft. You should also consider encrypting your backups and protecting them with a strong, unique passphrase. This way, only you can access them.
• Use Multi-Factor Authentication (MFA). If you’re using a cloud backup service, make sure to turn on MFA for your account. That way even if cybercriminals compromise your password, they won’t be able to access your data. If MFA is not available, use a strong, unique passphrase to protect your account. You can learn more about MFA at cyber.gov.au/MFA.
• Secure your backup devices. If you’re using a backup device such as a Network Attached Storage or a NAS device to store your backups, remember to secure these devices. Make sure they are updated regularly and protected with a strong, unique passphrase. These devices should be kept in a secure location that is only physically accessible by you.

You need to choose what data is important and what you want to keep safe in the event of data loss. For a business, think about the data that your business couldn’t function without such as calendars, emails, customer details and financial records.

Think about all of the devices in your home or business, from your smartphones and tablets to your computers or servers. Any devices with important data should be included in your backup plan.

You should also decide how much to include in your backup. You might just want to back up your important files such as photos, files and messages. Or, you could back up the entire system which will include your operating system, applications and all other data on your device. Backing up your entire system is known as a system image. It will take a snapshot of all data on your device so you can restore the entire system to an earlier point in time.

There are different ways to back up your important data. You could use a cloud backup service, an external storage device, or a combination of both.

Back up to the cloud

Cloud backup services use an internet connection to upload your data to a provider’s storage servers. For example, Microsoft OneDrive or Apple iCloud. If you need to access your backup, you can use the internet to download the data and restore it to your device.

There are different types of cloud services. A cloud backup service will usually store your current data as well as older versions of your data that you can restore in case of a cyber security incident. Cloud storage will let you save your files to the cloud but if the files on your machine are encrypted by ransomware, the files in cloud storage might also be encrypted and unrecoverable.

When using cloud for your backup, you should protect your account with multi-factor authentication and a strong passphrase. You should also research the cloud provider to ensure they are reputable and to check their history for data breaches or compromises. You might also consider using a zero-knowledge provider. This means that your backup will be encrypted before it is uploaded to the cloud. That way your backup service provider can’t read your data and it stays private.

The advantages of using cloud backup services include:

• Automatic and regular backups, usually done in real-time.
• An easy restore process if you ever need to get a copy of your data back.
• The backups can be stored securely in multiple geographic areas. This means that if there is a disaster at one backup location then your data should be safe at an alternate location. With some cloud providers your data could be securely stored in multiple locations around the world.
• Backup security is taken care of by the provider. Cloud backup service providers usually have experts taking care of backups and keeping them secure.
• Easy to set up and use if you have lots of devices.

Cloud backup might not be the right choice for you if:

• You have a slow internet connection. • Your internet plan has a low data limit.
• You don’t want to pay for a subscription.
• You’re worried about giving your data to a third party.
• You have lots of data to back up. Some providers have limits on the amount of data that can be backed up.

Back up to an external storage device

The other main way to back up your data is to use an external storage device that you own. There are many types of physical media you can use to backup your data. These include external hard drives, NAS devices, USB sticks and SD cards.

You should protect your backup device like any other copy of your data. It needs to be kept secure so you can rely on it in an emergency.

The advantages of backing up to an external storage device include:

• You keep control of your data and don’t give it to an external provider to take care of. This means you are not putting your data in the hands of another party who could be compromised.
• You control and own the backup device(s). That means that you know where your data is located in the world and can keep it in your control.
• Faster transfer speeds that don’t require an internet connection. Transferring data from your device to a device you own is typically faster than using a cloud service, it also doesn’t require an internet connection or data usage.
• You typically don’t have to pay ongoing subscription costs.

Backing up to an external storage device might not be the right choice for you if:

• You want a solution that is simple to set up.
• You want a solution that is “set and forget” and does not require manual intervention. For example, plugging in a USB to perform a manual backup or having to swap over hard drives.
• You don’t want to be responsible for securing the backup.
• You don’t want to pay an upfront cost. This could include purchasing hard drives or a NAS device and any third party software required to create the backups.
• You don’t want to manage hardware. Backup drives can fail which means you could lose a backup. You would also have to replace any drive that fails.
• You have lots of devices and don’t want to keep track of external storage for all of them.

When choosing how to back up your data you might also choose a hybrid backup. Hybrid backups can take the strengths of both cloud, and external storage solutions. For example, you could have the convenience of cloud backups for important files. Then use the faster transfer speeds of an external drive to back up a system image.

Below are two examples of a backup solution. These are designed to show you how you might take the advice above to implement a backup solution. When deciding how you will back up your data make sure you take your individual circumstances into account.

1. John has a Windows computer. To protect his personal data from disaster he uses a reputable cloud backup service which automatically backs up his operating system, programs and files. If his device was ever lost, damaged or stopped working, he would be able to restore his entire system onto a new device. It also keeps older versions of the backups, meaning that he could restore his files to an earlier point in time in case of a ransomware attack. John protects his cloud backup with a strong passphrase and multi-factor authentication, so nobody can get access but himself.
2. Mary runs a small business. She backs up their important files and server to a NAS device. The NAS device is updated regularly and the data is encrypted. The NAS device is then replicated to another NAS device which is kept at an offsite location.