Developing an Effective Data Protection Strategy

Suppose you arrive at work tomorrow morning and discover all the company data is gone. All your customer information, databases, billing, inventory and shipping records, project work, designs, prototypes, formulas--gone! How long could your company stay in business?

According to industry analysts, half of all businesses that lose their data go out of business shortly thereafter. Of those that do manage to stay alive, nine out of ten fail within two years.

It doesn't take much to wipe out a critical database of information. A hard disk crash, equipment failure or sudden loss of electricity can do it. Human error can lead to dropped computers or accidental erasure of data. Natural disasters abound from hurricanes to earthquakes, fires to floods. And, of course, there are malicious strikes from crackers, viruses and denial of service attacks.

Thus, the question isn't if you lose data, it's when. And although hardware, software and network equipment easily can be replaced, one of your most valuable assets--data--cannot.

The last few years have witnessed a growing number of federal, state and local laws and regulations regarding data storage and privacy. Much of this has been driven by identity theft as well as the unintentional posting of sensitive data on the Internet.

Like it or not, it's your responsibility to keep pace with federal legislation, such as the Health Insurance Portability and Accountability Act (HIPAA) of 1996. Among other things, it created over 68 information security conditions for protecting the confidentiality, integrity and availability of individual health information. It also defines requirements for storing patient information before, during and after electronic transmission. The Gramm-Leach-Bliley Act (GLBA) of 1999 requires financial institutions to disclose the practices they have instituted to protect confidential information, while state laws such as California's SB1386 require all companies conducting business electronically in the state to report breaches of security that could compromise personal information.

The time to create a backup strategy is before disaster strikes, so you can minimize data loss and business losses. Such a plan should be clear, specific and easy to follow and should incorporate several steps, starting with defining your needs. What you back up and how often you do it depends in part on the size of your company and the nature of your business. Consider these questions:

Once you answer those questions, you should prepare a needs assessment that addresses the following:

Time Retention

Many industries have federal, state and/or local laws and regulations that stipulate how long you must archive certain data. Other industries, including medical and legal, have their own rules for document retention. It's your responsibility to keep up with these regulations and to understand the legal consequences if you don't comply. Consequences can include fines, sanctions or even orders to shut down your business. Such legal requirements are addressed by specific archiving solutions.

On the other hand, you also may have company-defined levels of importance for your data. This requires you to keep some information for longer specified periods of time, which generates additional costs.

What Is Your Backup Window?

How much time do you have to create backups? Must they be done hourly, daily or monthly? Remember, the more often you back up data, the greater the chances you can recover an exact copy of what you need. However, a cost is involved in the time it takes to back up data (which may impact daily business operations) as well as the storage costs for archiving it.

Costs

Costs may be overlooked when it comes to backup strategies. Such costs include hardware, software and, of course, storage itself. But don't forget the costs for someone to oversee and maintain the backup procedure. Also, keep track of licensing fees for software.

Creating a Data Protection Strategy

Basically, any data protection strategy contains three parts: backup, archive and recovery. Let's start by considering the backup portion of the strategy.

When preparing a backup plan, you must consider several important factors, starting with administration. Who is going to control your backups? Will it be a single administrator or a team with primary and secondary responsibilities for managing and maintaining backups on a regular basis? In all cases--even if your system is automated--someone must be responsible for verifying and maintaining the solution. Without this clear organization, your backups quickly may become unusable.

Important, too, are the management tools an administrator has. A good management system should tell administrators what data is and is not backed up, which data can be ignored, which data is accessed and how often. Also, the administrator often is responsible for updating and maintaining protective measures, such as anti-virus software and firewalls, as well as encryption schemes to make data harder to steal or corrupt.

Finally, establish a periodic system testing schedule. Many a company has needed to restore data only to discover the backup media is corrupted or blank.