Periodic Backups

For decades now, Periodic Backups have been used to backup and safeguard critical data. Periodic backups are performed on a set schedule, rather than event-driven, such as whenever new data is saved to a hard drive or existing data files are modified. Periodic backups often perform one of three types of backup as follows:

1. Full Backup: backs all files targeted by the backup software.
2. Incremental Backup: backs up all changed files targeted by backup software since the last backup of any kind (full or differential).
3. Differential Backup: backs up all changed files targeted by the backup software since the last Full Backup.

These periodic backup strategies were developed when backup storage was very costly.  They try to balance the high cost of backing files up at a distinct cost to restoring data quickly and easily.

One advantage to doing a full backup is that a complete copy of all data is available within a single set of media (hard drive or Backup media – DVD, Tape etc.). This can reduce the total time to restore data, also known as a Recovery Time Objective (RTO). However, the disadvantages are that it takes longer to perform a full backup than other strategies (sometimes by a factor of 10 or more), and it requires more storage space.

However, in the modern days of ransomware, a distinct disadvantage of periodic backup strategies (Full, incremental, and differential) is that they do not usually perform backup versioning of the files. When a file is encrypted due to ransomware, its signature changes and it is therefore backed up.  In these cases, it may replace an older backup, destroying your access to a good version of the files in favor of a hacker encrypted version.  Strong periodic backup solutions will maintain multiple copies based upon time criteria of N – 7 days and N – 30 days.  In these cases, you may get most of your data back but for the last 7 or 30 days depending upon how far back the ransomware goes.  Additionally, some hackers may first seek out and delete your backups prior to starting their ransomware encryption routines with the hopes of increasing your willingness to pay their ransom demands.