Backup is Still Important - Options and Strategies for Accounting Firms

Data is king. Keeping it stored safely and securely is critical. Whether you are operating in the cloud, from an office, or from your home you need to be thoughtful about your data. In my professional life, strategies for keeping data safe have been mandatory for over 40 years. A consistent rule: to be able to recover, we have to have your data, no matter what. Further, the goal is to not lose any data on our watch.

If you have ultimate responsibility for the data in your office or home, you need to consider your strategies, your methods of backing up data and, ultimately, testing that you can restore from your data. This article will explain options, pitfalls and cautions on keeping your data safe. Further, you should comply with a written records retention policy. Backup copies, no matter where they are, need to be expired according to policy. The potential liability in keeping old backup, such as tape or USB sticks, for an extended period of time without managing expiration is extremely risky. Cloud vendors used for backup may also keep backup copies beyond your retention policy, including copies after you leave their service. For example, Microsoft deletes your files within 30 days of leaving their Office 365 service, but other vendors keep your data permanently.

What Options are Available?

Recommendations for good backup vary based on your size, recovery time objective (RTO or amount of time to recover), recovery point objective (RPO-how much data you are willing to lose), and your fault tolerance level. The quicker you want to recover and the less data you are willing to lose, the more expensive the approach will be. However, relatively short RTO and RPO is possible by using backup appliances. Backup appliances combine software and hardware into a product that operates with relatively little intervention to back up your data frequently and securely.

Costs vary widely by the solution. Clearly for homes and small firms, USB drives and Network Attached Storage (NAS) units are the low cost alternative, where a few terabytes of storage cost a few hundred dollars per month. Software frequently comes with a NAS for backup purposes. However a copy of your data needs to be in some off-site location, whether that is in the cloud or another home or office. Additionally USB and NAS alternatives typically don’t backup open files, SQL databases or email files correctly. When off-site cloud storage is used, expect costs in the fifty cent to one dollar (per gigabyte per month) range, although non-professional home grade storage is typically less expensive. You should not use home grade storage for professional purposes because the data does not have adequate protection. We expect providers to offer in excess of one terabyte of storage at no charge this year. Backup Appliances vary in price between $3,000 and $11,000. Two backup appliances can be used to backup from a primary location to a secondary location, eliminating the cloud storage costs, and potentially speeding the recovery process. If you contact me directly, I’d be pleased to review options with you directly, help you filter and select possible options, and obtain accurate pricing estimates for your situation. There would be no better use of my time than helping you or your firm prevent a loss of data.

The chart below illustrates some of the options available:

Approach	Benefits	Potential Shortfalls
Run in the cloud with all Software as a Service applications or at a cloud hosting service	Agreements provide for backup so you can “not worry about it” OR you can do a reverse backup from the cloud and have copies of the data in the cloud and in your office	Data will not be available during outages, service provider may have catastrophic loss and not have an appropriate backup site or failover plan (not particularly likely)
Tape drive	Long archival life	Long backup times possible, tapes prone to failure, manual rotation of backup media required, backup software has to be configured and updated, destruction of tapes needed for compliance with document retention policies, long restore times
USB drive	Inexpensive	May not be secure, needs encryption, has to be carried off-site for additional safety, manual intervention to complete backup, prone to failure
Network Attached Storage (NAS) drive	Inexpensive, faster than USB, may have provision for sharing in and out of the office	An off-site backup is still needed, perhaps a NAS in the office and a NAS in your home OR a NAS in your home and that of another family member OR a NAS in your office and home and a web based backup
Web based backup	Simple, off-site, easy to restore single files, may be near continuous	Large scale restores time consuming, pricing likely to increase when more data stored
Appliance based backup	Frequent copies of data made (typically every 15 minutes), rapid single file restore, multiple versions of data stored, can run as substitute virtual servers, can back up to the web or another backup appliance in a different location	Need to purchase sufficient size drives and processors, possible to outgrow, have to be replaced every five years, off-site storage to the web fees increase with more storage, need to be tested on a regular basis (weekly, minimum monthly)
Storage Area Network (SAN) replication	Can allow continuous operation even in the event of a catastrophic failure. High probability of losing little or no data. Replication of virtual machines possible with a product like VEEAM	Virus infection or deleted files are immediately replicated to the alternate site…an archival backup is still needed. Communication speed and systems cost can be high. Consider using your older SAN (that has been used for five years) by moving it to your backup site and installing a new SAN in your primary site

Pitfalls and Cautions

Things can go wrong with your data and corrupt either production files or backups. Cloud hosting and SaaS applications minimize the amount of responsibility you have for protecting the data. However, some vendors “lock the data up” and prevent you from getting your data back easily.

If you keep your data locally in your firm or home, user error, mechanical failure, intentional internal or external maliciousness, or other intrusions like viruses can destroy all of your data. Data may be mechanically safer in the cloud, but the regulatory risks increase. For example, the Patriot Act Section 215 provides for access to data stored in any data center without subpoena or notification in the U.S. According to our research over 25,000 such requests have already been made with less than 20 of the requests denied. If you store client confidential data in the cloud, this data may be provided to governmental agencies without your knowledge. According to Time Magazine, November 11, 2013, page 31, there is approximately 19 terabytes of information stored on the public web. There are another 7500 terabytes of information stored on the hidden or secret web that is used by government agencies and criminals alike.

Although not comprehensive, the following illustrates some of the issues for you to consider:

Situation	Possible Cause	Resolution or Options
Primary production file corrupted	Power inconsistent, software error, mechanical failure	Restore from backup after issue is corrected
Bad file written over the top of a good file	User error made in application, then saved, commonly done in Excel	Attempt to restore a version from document management or computer file system, otherwise retrieve single file from backup
Hard drive (HD) or solid state drive (SSD) failure	Mechanical issue	Replace unit and restore all files from backup
USB thumb drive unreadable	Physical damage	Use new USB drive and restore from backup
Synchronized cloud storage missing files (SkyDrive, Dropbox)	User intentionally or accidentally deleted files	Check for hidden prior versions or restore from backup
New backup provider chosen	Better alternative found	Ensure that all files are deleted from old provider. Check on retention period to confirm files will be removed to minimize eDiscovery risk
Production or backup files stolen or compromised and were not encrypted	Error was made in setup by IT-all drives should be encrypted.	Execute security breach reporting plan. Requirements vary by state.
Catastrophic loss of office or home from fire, flood or other cause	Bad luck or not proactively repairing faulty equipment.	Find new location if necessary, purchase appropriate equipment, restore from backup
Volume of data is so large, restoring the backup will take too much time	Internet too slow, or inappropriate product was initially chosen	Ask vendor to ship an encrypted drive with your information for restore purposes
Want to leave a cloud vendor and you need your data	Vendor is not responding or taking a protracted amount of time	Review the contractual obligation (which should have also been done originally) and ask for compliance with contract
Data center is down	Various including operational error or mechanical failure	Largely beyond your control. Prepare in advance with a communication plan to your clients, and wait. Have manual procedures ready to execute
Backup won’t restore	Backup probably wasn’t tested on a regular basis	Try earlier versions of backups. Implement regular restore testing procedure (weekly/ monthly). May be contracted to a managed service provider.

Key concerns with any backup data is the ability to restore, the protection of the data, the application of records retention policies, and the amount of time required to either backup or restore. With the 2013 disclosure of decryption technology held by governments around the world, my comfort level has dropped with cloud hosting, SaaS applications, and cloud-based backup. However, my caution primarily lies around risk mitigation and unexpected exposure of client confidential data. Make sure you have read the license agreement of any cloud storage provider before you use the service. Test your backups for reliability on a regular basis. And make sure you have ALL of your data backed up no matter what!

Backup is Still Important – Options and Strategies for Accounting Firms

See inside February 2014

How Small Businesses Can Increase Customer Loyalty & Branding

E-Signatures – The New Normal