Backup Retention

[chekmate1984]

What is backup retention all have at present?

 

We have 365 days immutabiltiy. I am looking to reduce that to 3 months but wanted to know if there is a DFE guidelines on this?

 

Thanks

[MartinT]

We have retention on air-gapped disk caddy of one term. Retention on CT cloud backup is one year.

 

Normal backups on the server have a grandfather-father-son setup, so maximum retention 3 weeks.

[psydii]

Its a local choice that needs to be informed by your data retention scheme. You have to hold some data for many years, and you are unlikely to be accessing much of this data frequently, so it might take a long time before you notice something has been deleted or corrupted. Your backup retention needs to be sufficient that you are able to recover data that you are required to keep.

 

One solution might be that you have a set of backup repositories with appropriate retention policies (e.g. retain until 2029, retain until 2030, retain until 2031...) into which you place *just* the backups of important data aligned with how long you need to keep them on an annul basis a(e.g. financial, CP, Safeguarding, SEN etc).

 

And then everything else can be on a much shorter policy (6 months might be fine). If you have local DC's remember that backups have a shelf life so it is questionable to be keeping them around for a year.

 

Also it seems to be a thing that the bad-guys sometime sit inside networks for months before launching a ransomware attack. So there is merit in having some backups held for longer (though once a domain is compromised, any restored-backups are also compromised due to certain keys deep in AD being immutable).

 

So it depends.

[pete]

This is a discussion to have with management.

 

I'd also echo @psydii's suggestion that you have longer than 3 months of company data available. Any sensible ransomware actor is going to compromise and then wait a bit.

[MartinT]

Machine backups are different from data.

 

Our 365 data retention policy is 7 years for staff and until age 25 for students. We use Barracuda cloud-to-cloud backup for that and the retention rules are appropriately set in 365.