Security and Backup Policies
Who is Responsible?
Under UK law, it is the directors of an organisation (not the IT department or security officers) who can be held personally responsible for the security of their networks. Therefore, they ought to be very supportive of a security policy.
Backup Strategies
Key questions that must be addressed when planning a backup strategy are:
How often? (every day or every time a record is collected)
What should be backed up? (software and data but only data needs to be backed up every day)
Where should backups be stored? (off-site or in a fireproof safe)
Full backup takes more time than incremental backup and the computer cannot be used for any other task while the backup is in progress.
With an incremental backup system, a full backup is taken only once a week. On other days, an incremental backup is done where only new and changed files are saved.
Heathcote has an example of a backup strategy on p.293 and a good case study on p.294
Backup Hardware
Tape drives and the tapes themselves are quite expensive and also quite slow but they can store a massive amount of data.
Iomega Zip disks are like "super floppy disks". They hold more data than a normal floppy (100 or 200MB) and they are faster. However, the capacity is not large enough to do a full backup even a home PC.
CDR and CDRW drives are becoming popular as backup hardware for the home user and small business. A CD can hold 650MB. Blank CDs are extremely cheap.
Some businesses back up onto the Internet. This is a good idea because the backup is in a remote location. There is a fear of hackers but the data is held in encrypted format.
Online Backup
RAID = Redundant Array of Inexpensive Drives
Every transaction is saved on three hard disks (a second drive in case the first fails and the third in a remote location). This is suitable for those businesses that cannot afford to lose even a day's work.
Grandfather-Father-Son Backup
In organisations that use batch processing, it is not necessary to back up every night. The system uses "generations" of master files. A new generation of the master file is created each time a day's transactions are processed. At least 4 generations are kept and on the 5th day, the oldest generation (the grandfather) is overwritten. At least one generation is kept offline in a secure fireproof safe, with at least one pair off-site.
There is an explanation and diagram of this on Heathcote p.295