What is the best way to secure your network backups?

In my opinion, based on experience and training, some of the best approach to securing your network backups, includes: 1. Have an information security program who strategy and objectives align with corporate strategy and objectives. 2. Execute a Business Impact analysis to identify critical infrastructure that requires backing up 3. Design and implement backup strategy that commensurate with infrastructure criticality. 4. Assess (audit) the implementation of the backup strategy for adequacy and effectiveness. 5. If gaps are identified; take corrective and improvement actions. 6. Develop and implement continuous monitoring strategy for backup infrastructure. Ensure frequent testing of your backups. Backups are useless if not tested.

Securing network backups in telecommunications demands a comprehensive strategy. Employing robust encryption ensures data confidentiality during transmission and storage. Strict access controls and authentication mechanisms limit unauthorized access. Regular auditing and monitoring and real-time alerts, provide a proactive defense against threats. Off-site storage adds resilience in case of physical breaches or disasters. Following the "3-2-1 backup rule" with redundant copies on diverse media types minimizes data loss risks. Regular validation of backup restoration processes ensure readiness for crisis scenarios. In an evolving telecommunications landscape, this multi-layered approach is vital for maintaining data integrity /availability

Automatic backup is a good choice as time spent is also very important consideration. Earlier experience on back up and recovery will play an important role on the selected choice of a user.

Oxidized is a small but very useful program for centralized backup of configuration files of network equipment. Also, which is very useful, it can display changes in settings - this allows you to quickly understand what exactly has changed. The open-source utility allows you to perform periodic both local and remote backups. It can be used for the backup text configuration (git as a storage) or bundle binary configuration (archives, certs etc).

Any backup solution should follow the famous rule 3-2-1. You should have 3 versions of your data: 1. Working copy 2. Two backups The 2 backups should be backed up on two different strategies or mediums, for example: 1. NAS 2. Cloud backup And 1 of those backups should be offsite, for example Cloud. Hence depending on your application or data, select the 3-2-1 strategy that works for you and is always running on autopilot.

Encryption is crucial in this age, no data should be stored in plaintext or transferred in plaintext. Most backup solutions have encryption built-in, make sure if you are using a key or password that it is stored in a completely separate location and apart from your backup.

Encrypt backup data using robust algorithms and secure keys. Apply encryption at the highest level feasible, whether file, device, or network. For cloud backups, encrypt data pre-upload, use secure connections, and employ strong access passwords. Local backups require on-device encryption, coupled with physical security measures. Encrypting at multiple layers enhances data protection against unauthorised access or interception.

As mentioned, authorization and authentication are required in two cases: in order to exclude unauthorized access to stored backups and in order to exclude the addition of fake backups to the repository (attack vector). Oxidize operates in pull mode and has built-in authorization tools for accessing network equipment: it supports many different types of authorization. To authorize clients, you need to use external tools, for example nginx in reverse-proxy mode or CloudFlare ZeroTrust tunnels etc.

In my practice, I use daily automatic backup for all network devices locally and to a remote perimeter (protection against ransomware attacks). With this schedule, Oxidize allows me to see the difference between each new backup and restore the configuration for any date.

I think this is best to secure network backup , with this method we need to know if any change requires or not , scheduling remind us time to time update and enhancements if required

As a Perimeter Resilience Tech Lead, I am also responsible for PCI scope. When creating backups from PCI scope, the corresponding procedures are applied In accordance with PCI DSS: encryption requirements, transfer requirements and storage location of backups. Even when we back up less critical data, we always store backups in different locations: locally and in a remote region.

In my experience having secure best IT security and network policies that protect your backup and systems to improve security avoidance of risk of not accessing important information

Before you start designing and configuring a backup, define for yourself its goals and scenarios for using backups. Describe all possible threat vectors (hardware failure, ransomware, upgrade, etc.). Be sure to formalize data recovery procedures for various scenarios and periodically check the integrity of backups and the ability to restore them. Do not store backups in one instance and in one place!

When deploying out whatever backup solution you've decided to implement, document, document, and document some more. Test at every stage to confirm an easy transition.

One thing I’ve found helpful is itemizing the folders according the order of security importance. As backup processes are relative to the sensitivity/nature of information in context. Sort out certain sensitive information that would require all of the above itemized forms of backup (cloud storage/2-step authentication passcodes/encryption) to cut cost. For other files, select one the I’d recommend the 2-step verification process. I hope this helps.