An Investigation of Approaches to Improving the
Data Backup Management Processes in SMEs

We are all aware of how critical it is for a business to ensure that their data is adequately and securely backed up on a regular basis. However it is common for small organisations to have no backup policy in place or if they do have a backup procedure, they are unaware if it is actually backing up their data when it is meant to. This poses a challenge for small businesses. What would happen to them should they lose critical data only then to realise that it had not been backed up? Is there a specific reason why some businesses do not ensure that their data is backed up? Those that do have a backup plan in place – do they ever perform any disaster recovery scenarios or any backup testing based on their backup policy formation plans (if present)?

This research focuses on current best practice strategies used to backup data along with those commonly used within Irish small businesses and also looks at how effective these strategies are and if they could be improved by meeting needs and expectations of the user. Using survey based research; this research will present in detail the technological strategies currently in place and will examine the level of satisfaction these strategies provide. It also investigates what newer technologies might be suitable to aid in this process or additional features may help users ensure that their business critical data is backed up with confidence. This research also investigates some of the reasons why data backup strategies are not used or why they are not effectively monitored and tested by the businesses. This work is used to define methods of how to improve the data backup process currently used by Irish SMEs using information gathered out of this process.

Given the current economic climate, Irish businesses are trying to ensure that all costs are kept to a minimum. However, this should not be at the expense of essential services including data backups. From anecdotal evidence, it appears that many companies make assumptions about their data backups in terms of the backup being performed and also in terms of the potential to restore the data if required. Traditional backup systems were often too complex for non-technical users or they were too costly. In recent years, the software options available have improved drastically, especially now that remote services have become available using the internet. At the same time, the technologies have significantly come down in price.

SMEs are a significant employer in Ireland, employing about 1.5 million people prior to the economic downturn. Of this, about half work in companies employing fewer than 50 people. SMEs can be divided into three categories, micro (employees <10), small (employees <50) and medium (employees <250). For this project I will focus on SMEs, defined as all firms with less than 250 employees in both services and industry, but excluding construction. The category includes the following sectors: Health, Wholesale and Retail, Hospitality, Industry, Business Services, Transport, Communication, Financial Services, Education and other services.

The author experienced a situation recently where a company ran a query on a live customer database but instead of selecting records, they ended up deleting all customers that had an email address. When told to use their previous day’s backup to restore the data, it turned out that they had not been making backups for about six weeks as their backup drive was full! Although the customer should not have had the ability to run queries against live data, they should have had the confidence that any unintended changes could easily be restored. A similar situation arose when a junior staff member allegedly lost an entire database of child benefits of 25 million people.

According to industry experts, many SMEs are exposing themselves to risks as they either aren’t backing up or are not using an effective means to back up their data to protect it from fire, flood, viruses, corruption and even human error. Many companies still use archaic systems to back up their business critical data whilst others simply copy onto unencrypted media (CD/DVD/USB drives). According to James Finglas, managing director, MJ Flood Technology. "SMEs have very little knowledge about disaster recovery and it's very low down their agenda in terms of IT spend. And, as recessionary times bite, it has moved even further down their agenda”. This view is in line with that of Eoin Blacklock, MD of keepITsafe who claims that 95% of SMEs are not prepared at all for disaster recovery.

With new technologies being developed and existing ones coming down in price, the range of backup and recovery options available to users has become wide. Remote backups, an idea unthinkable ten years ago for most is not a realistic option. Virtualisation has made the process for many organisations much easier than they had imagined. Some organisations even use free mail account to backup important emails (although this would not be regarded as a secure backup method).

It should also be noted that data backups are not just important should a file become lost or corrupted. Kaspersky have warned that ransomware is a serious threat and if taken, a user’s data cannot be recovered without paying the extortion charge.

The project will provide an analysis of some of the commonly used data backup providers along with an example of tape backup system and its reports. The data backup providers generally provide software that encrypts the data locally before copying it to a remote location.