Posey's Tips & Tricks
Are Zero Backups About to Become Relevant?
Traditional backups remain essential, but their growing security, legal, and operational risks raise the question of whether limited or "zero backup" strategies might someday offer advantages -- if their major shortcomings can be addressed.
Many years ago, I attended a Microsoft event during which one of the speakers pitched the idea of eliminating traditional backups for Exchange Server in favor of something called zero backups. The basic idea behind this philosophy was that Exchange Serve backups are pointless because mailbox data has such a high change rate. The speaker argued that it's better to just create an insane amount of redundancy and that the redundancy would eliminate the chances of data loss, thereby making traditional backups obsolete.
As the saying goes, the idea of zero backups has aged like fine milk. The big problem with zero backups is that traditional recovery point restorations become impossible. While the point about Exchange having an extremely high data change rate is valid, relying on redundancy and replication alone isn't the answer. After all, if the Exchange information store were to become corrupted, the corruption would presumably be propagated to all of the redundant Exchange Servers at machine speed (although there are ways to create delayed replicas).
In spite of its many shortcomings, I have actually been thinking a lot about zero backups lately. Now please don't understand me. I am most certainly not advocating abandoning your backups in favor of zero backups. Even so, I just can't help but to wonder if maybe there is some merit to zero backups after all and if there might be some sort of way to get around the shortcomings.
This of course, raises the question of why I am suddenly reevaluating zero backups. In all honesty, it's because I am starting to view traditional backups as a double edged sword,
On one hand, traditional backups are absolutely essential. When bad things happen, backups represent your best option for getting your data back. On the other hand though, backups can become a liability.
Part of the reason for this is that backups (and even backup consoles) have become extremely high value targets for attackers.
Just for the sake of illustration, let's pretend for a moment that an attacker manages to gain full, unrestricted access to a backup console, and yet for some crazy reason cannot access the backups themselves. The backup console could potentially be a treasure trove for the attacker. Depending on the safeguards built into the console, the attacker could potentially gain access to credentials, SaaS tokens, APIs, and more. This is without ever gaining access to the backup itself.
Of course the backups themselves are even more useful to an attacker. An attacker who gains access to the backups could potentially use the backups as a tool for exfiltrating data from the organization. This exfiltrated data could then be sold to the highest bidder. Similarly, the attacker could use the exfiltrated data as the basis for a cyber extortion scheme, threatening to release the data unless a ransom is paid.
Even if you take cyber attacks out of the equation, backups could become a liability in that they may contain data that the organization wishes it could delete. Imagine for a moment that an organization is required to submit to an eDiscovery process tied to litigation against the organization. Now, imagine that the organization is legally required to keep three years worth of data, but the organization has old backups going back five years. Even though the organization isn't required to keep such old backups, the simple fact that the backups exist makes their contents fair game for eDiscovery, and there is a possibility that the old backups may contain information that can be used against the organization.
While it's true that an application that is receiving the zero backup treatment might also contain old data that is no longer required to be retained, all of that application's data lives in a single place. As such, it would conceivably be possible to implement a data lifecycle management policy that purges old data and the organization would not have to worry about the possibility that an old backup tape choked full of incriminating data might still be laying around somewhere.
About the Author
Brien Posey is a 22-time Microsoft MVP with decades of IT experience. As a freelance writer, Posey has written thousands of articles and contributed to several dozen books on a wide variety of IT topics. Prior to going freelance, Posey was a CIO for a national chain of hospitals and health care facilities. He has also served as a network administrator for some of the country's largest insurance companies and for the Department of Defense at Fort Knox. In addition to his continued work in IT, Posey has spent the last several years actively training as a commercial scientist-astronaut candidate in preparation to fly on a mission to study polar mesospheric clouds from space. You can follow his spaceflight training on his Web site.