Post Syndicated from Kari Rivas original https://www.backblaze.com/blog/server-backup-101-on-premises-vs-cloud-only-vs-hybrid-backup-strategies/

As an IT leader or business owner, establishing a solid, working backup strategy is one of the most important tasks on your plate. Server backups are an essential part of a good security and disaster recovery stance. One decision you’re faced with as part of setting up that strategy is where and how you’ll store server backups: on-premises, in the cloud, or in some mix of the two.

As the cloud has become more secure, affordable, and accessible, more organizations are using a hybrid cloud strategy for their cloud computing needs, and server backups are particularly well suited to this strategy. It allows you to maintain existing on-premises infrastructure while taking advantage of the scalability, affordability, and geographic separation offered by the cloud.

If you’re confused about how to set up a hybrid cloud strategy for backups, you’re not alone. There are as many ways to approach it as there are companies backing up to the cloud. Today, we’re discussing different server backup approaches to help you architect a hybrid server backup strategy that fits your business.

Server Backup Destinations

Learning about different backup destinations can help administrators craft better backup policies and procedures to ensure the safety of your data for the long term. When structuring your server backup strategy, you essentially have three choices for where to store data: on-premises, in the cloud, or in a hybrid environment that uses both. First, though, let’s explain what a hybrid environment truly is.

Here are some examples of different server backup destinations according to where your data is located:

• Local backup destinations.
• Cloud-only backups.
• Hybrid cloud backups.

Local Backup Destinations

On-premises backup, also known as a local backup, is the process of backing up your system, applications, and other data to a local device. Tape and network-attached storage (NAS) are examples of common local backup solutions.

• Tape: With tape backup, data is copied from its primary storage location to a tape cartridge using a tape drive. Tape creates a physical air gap, meaning there’s a literal gap of air between the data on the tape and the network—they are not connected in any way. This makes tape a highly secure option, but it comes at a cost. Tape requires physical storage space some businesses may not have. Tape maintenance and management can be very time consuming. And tapes can degrade, resulting in data loss.
• NAS: NAS is a type of storage device that is connected to a network to allow data processing and storage through a secure, centralized location. With NAS, authorized users can access stored data from anywhere with a browser and a LAN connection. NAS is flexible, relatively easy to scale, and cost-effective.

Cloud-only Backups

Cloud-only backup strategies are becoming more commonplace as startups take a cloud-native approach and existing companies undergo digital transformations. A cloud-only backup strategy involves eliminating local, on-premises backups and sending files and databases to the cloud vendor for storage. It’s still a great idea to keep a local copy of your backup so you comply with a 3-2-1 backup strategy (more on that below). You could also utilize multiple cloud vendors or multiple regions with the same vendor to ensure redundancy. In the event of an outage, your data is stored safely in a separate cloud or a different cloud region and can easily be restored.

With services like Cloud Replication, companies can easily achieve a solid cloud-only server backup solution within the same cloud vendor’s infrastructure. It’s also possible to orchestrate redundancy between two different cloud vendors in a multi-cloud strategy.

Hybrid Cloud Backups

When you hear the term “hybrid” when it comes to servers, you might initially think about a combination of on-premises and cloud data. That’s typically what people think of when they imagine a hybrid cloud, but as we mentioned earlier, a hybrid cloud is a combination of a public cloud and a private cloud. Today, private clouds can live off-premises, but for our purposes, we’ll consider private clouds as being on-premises. A hybrid server backup strategy is an easy way to accomplish a 3-2-1 backup strategy, generally considered the gold standard when it comes to backups.

Choosing a Backup Strategy

Choosing a backup strategy that is right for you involves carefully evaluating your existing systems and your future goals. Can you get there with your current backup strategy? What if a ransomware or distributed denial of service (DDoS) attack affected your organization tomorrow? Decide what gaps need to be filled and take into consideration a few more crucial points:

• Evaluate your vulnerabilities. Is your location susceptible to a local data disaster? How often do you think you might need to access your backups? How quickly would you need them?
• Price. Various backup strategies will incur costs for hardware, service, expansions, and more. Carefully evaluate your organization’s finances to decide on a budget. And keep in mind that monthly fees and service charges may go up over time as you add more storage or use enhanced backup tools.
• Storage capacity. How much storage capacity do you have on-site? How much data does your business generate over a given period of time? Do you have IT personnel to manage on-premises systems?
• Access to hardware. Provisioning a private cloud on-premises involves purchasing hardware. Increasing supply chain issues can slow down factories, so be mindful of shortages and increased delivery times.
• Scalability. As your organization grows, it’s likely that your data backup needs will grow, too. If you’re projecting growth, choose a data backup strategy that can keep up with rapidly expanding backup needs.

Backup Strategy Pros and Cons

Local Backup Strategy

• Pros: A major benefit to using a local backup strategy is that organizations have fast access to data backups in case of emergencies. Backing up to NAS can also be faster locally depending on the size of your data set.
• Cons: Maintaining on-premises hardware can be costly, but more important, your data is at a higher risk of loss from local disasters like floods, fires, or theft.

Cloud Backup Strategy

• Pros: With a cloud-only backup strategy, there is no need for on-site hardware, and backup and recovery can be initiated from any location. Cloud resources are inherently scalable, so the stress of budgeting for and provisioning hardware is gone.
• Cons: A cloud-only strategy is susceptible to outages if your data is consolidated with one vendor, however this risk can be mitigated by diversifying vendors and regions within the same vendor. Similarly, if your network goes down, then you won’t have access to your data.

Hybrid Cloud Backup Strategy

• Pros: Hybrid cloud server backup strategies combine the best features of public and private clouds: You have fast access to your data locally while protecting your data from disaster by adding an off-site location to your backup strategy.
• Cons: Setting up and running a private cloud server can be very costly. Businesses also need to plan their backup strategy a bit more thoughtfully because they must decide what to keep in a public cloud versus a private cloud or on local storage.

Hybrid Server Backup Considerations

Once you’ve decided a hybrid server backup strategy is right for you, there are many ways you can structure it. Here are just a few examples:

• Keep backups of active working files on-premises and move all archives to the cloud.
• Choose a cutover date if your business is ready to move mostly to the cloud going forward. All backups and archives prior to the cutover date could remain on-premises and everything after the cutover date gets stored in cloud storage.
• Store all incremental backups in cloud storage and keep all full backups and archives stored locally. Or, following the Grandfather-Father-Son (GFS) approach, put the father and son backups in the cloud and grandfather backups in local storage. (Or vice versa.)

As you’re structuring your server backup strategy, consider any GDPR, HIPAA, or cybersecurity requirements. Does it call for off-site, air-gapped backups? If so, you may want to move that data (like customer or patient records) to the cloud and keep other, non-regulated data local. Some industries, particularly government and heavily regulated industries, may require you to keep some data in a private cloud.

Ready to get started? Back up your server using our joint solution with MSP360 or get started with Veeam or any one of our many other integrations.

The post Server Backup 101: On-premises vs. Cloud-only vs. Hybrid Backup Strategies appeared first on Backblaze Blog | Cloud Storage & Cloud Backup.

Post Syndicated from Kari Rivas original https://www.backblaze.com/blog/server-backup-101-choosing-a-server-backup-solution/

If you’re in charge of backups for your company, you know backing up your server is a critical task to protect important business data from data disasters like fires, floods, and ransomware attacks. You also likely know that digital transformation is pushing innovation forward with server backup solutions that live in the cloud.

Whether you operate in the cloud, on-premises, or with a hybrid environment, finding a server backup solution that meets your needs helps you keep your data and your business safe and secure.

This guide explains the various server backup solutions available both on-premises and in the cloud, and how to choose the right backup solution for you. Read on to learn more about choosing the right server backup solution for your needs.

On-premises Solutions for Server Backup

On-premises solutions store data on servers in an in-house data center managed and maintained internally. Although there has been a dramatic shift from on-premises to cloud server solutions, many organizations choose to operate their legacy systems on-premises alone or in conjunction with the cloud in a hybrid environment.

LTO/Tape

Linear tape-open (LTO) backup is the process of copying data from primary storage to a tape cartridge. If the hard disk crashes, the tapes will still hold a copy of the data.

Pros:

• High capacity.
• Tapes can last a long time.
• Provides a physical air gap between backups and the network to protect against threats like ransomware.

Cons:

• Up-front CapEx expense.
• Tape drives must be monitored and maintained to ensure they are functioning properly.
• Tapes take up lots of physical space.
• Tape is susceptible to degradation over time.
• The process of backing up to tape can be time consuming for high volumes of data.

NAS

Network-attached storage (NAS) enables multiple users and devices to store and back up data through a secure server. Anyone connected to a LAN can access the storage through a browser-based utility. It’s essentially an extra network strictly for storing data that users can access via its attached network device.

Pros:

• Faster to restore files and access backups than tape backups.
• More digitally intuitive and straightforward to navigate.
• Comes with built-in backup and sync features.
• Can connect and back up multiple computers and endpoints via the network.

Cons:

• Requires physical maintenance and periodic drive replacement.
• Each appliance has a limited storage capacity.
• Because it’s connected to your network, it is also vulnerable to network attacks.

Local Server Backup

Putting your backup files on the same server or a storage server is not recommended for business applications. Still, many people choose to organize their backup storage on the same server the data runs on.

Pros:

• Highly local.
• Quick and easy to access.

Cons:

• Generally less secure.
• Capacity-limited.
• Susceptible to malware, ransomware, and viruses.

Including these specific backup destinations, there are some pros to using on-premises backup solutions in general. For example, you might still be able to access backup files without an internet connection using on-premises solutions. And you can expect a fast restore if you have large amounts of data to recover.

However, all on-premises backup storage solutions are vulnerable to natural disasters, fires, and water damage despite your best efforts. While some methods like tape are naturally air-gapped, solutions like NAS are not. Even with a layered approach to data protection, NAS leaves a business susceptible to attacks.

Backing Up to Cloud Storage

Many organizations choose a cloud-based server for backup storage instead of or in addition to an on-premises solution (more on using both on-premises and cloud solutions together later) as they continue to integrate modern digital tools. While an on-premises system refers to data hardware and physical storage solutions, cloud storage lives “in the cloud.”

A cloud server is a virtual server that is hosted in a cloud provider’s data center. “The cloud” refers to the virtual servers users access through web browsers, APIs, CLIs, and SaaS applications and the databases that run on the servers themselves.

Because cloud providers manage the server’s physical location and hardware, organizations aren’t responsible for managing costly data centers. Even small businesses that can’t afford internal infrastructure can outsource data management, backup, and cloud storage from providers.

Pros

• Highly scalable since companies can add as much storage as needed without ever running out of space.
• Typically far less expensive than on-premises backup solutions because there’s no need to pay for dedicated IT staff, hardware upgrades or repair, or the space and electricity needed to run an on-premises system.
• Builds resilience from natural disasters with off-site storage.
• Virtual air-gapped protection may be available.
• Fast recovery times in most cases.

Cons

• Cloud storage fees can add up depending on the amount of storage your organization requires and the company you choose. Things like egress fees, minimum retention policies, and complicated pricing tiers can cause headaches later, so much so that there are companies dedicated to helping you decipher your AWS bill, for example.
• Can require high bandwidth for initial deployment, however solutions like Universal Data Migration are making deployment and migrations easier.
• Since backups can be accessed via API, they can be vulnerable to attacks without a feature like Object Lock.

It can be tough to choose between cloud storage vs. on-premises storage for backing up critical data. Many companies choose a hybrid cloud backup solution that involves both on-premises and cloud storage backup processes. Cloud backup providers often work with companies that want to build a hybrid cloud environment to run business applications and store data backups in case of a cyber attack, natural disaster, or hardware failure.

If you’re stuck between choosing an on-premises or cloud storage backup solution, a hybrid cloud option might be a good fit.

All-in-one vs. Integrated Solutions

When it comes to cloud backup solutions, there are two main types: all-in-one and integrated solutions.

Let’s talk about the differences between the two:

All-in-one Tools

All-in-one tools are cloud backup solutions that include both the backup application software and the cloud storage where backups will be stored. Instead of purchasing multiple products and deploying them separately, all-in-one tools allow users to deploy cloud storage with backup features together.

Pros:

• No need for additional software.
• Simple, out-of-the-box deployment.
• Creates a seamless native environment.

Cons:

• Some all-in-one tools sacrifice granularity for convenience, meaning they may not fit every use case.
• They can be more costly than pairing cloud storage with backup software.

Integrated Solutions

Integrated solutions are pure cloud storage providers that offer cloud storage infrastructure without built-in backup software. An integrated solution means that organizations have to bring their own backup application that integrates with their chosen cloud provider.

Pros:

• Mix and match your cloud storage and backup vendors to create a tailored server backup solution.
• More control over your environment.
• More control over your spending.

Cons:

• Requires identifying and contracting with more than one provider.
• Can require more technical expertise than with an all-in-one solution, but many cloud storage providers and backup software providers have existing integrations to make onboarding seamless.

How to Choose a Cloud Storage Solution

Choosing the best cloud storage solution for your organization involves careful consideration. There are several types of solutions available, each with unique capabilities. You don’t need the most expensive solution with bells and whistles. All you need to do is find the solution that fits your business model and future goals.

However, there are five main features that every organization seeking object storage in the cloud should look out for:

Cost

Cost is always a top concern for adopting new processes and tools in any business setting. Before choosing a cloud storage solution, take note of any fees or file size requirements for retention, egress, and data retrieval. Costs can vary significantly between storage providers, so be sure to check pricing details.

Ease-of-use and Onboarding Support

Adopting a new digital tool may also require a bit of a learning curve. Choosing a solution that supports your OS and is easy to use can help speed up the adoption rate. Check to see if there are data transfer options or services that can help you migrate more effectively. Not only should cloud storage be simple to use, but easy to deploy as well.

Security and Recovery Capabilities

Most object storage cloud solutions come with security and recovery capabilities. For example, you may be looking for a provider with Object Lock capabilities to protect data from ransomware or a simple way to implement disaster recovery protocols with a single command. Otherwise, you should check if the security specs meet your needs.

Integrations

All organizations seeking cloud storage solutions need to make sure that they choose a compatible solution with their existing systems and software. For example, if your applications speak the S3 API language, your storage systems must also speak the same language.

Many organizations use software-based backup tools to get things done. To take advantage of the benefits of cloud storage, these digital tools should also integrate with your storage solution. Popular backup solutions such as MSP360 and Veeam are built with native integrations for ease of use.

Support Models

The level of support you want and need should factor into your decision-making when choosing a cloud provider. If you know your team needs fast access to support personnel, make sure the cloud provider you choose offers a support SLA or the opportunity to purchase elevated levels of support.

Questions to Ask Before Deciding on a Cloud Storage Solution

Of course, there are other considerations to take into account. For example, managed service providers will likely need a cloud storage solution to manage multiple servers. Small business owners may only need a set amount of storage for now but with the ability to easily scale with pay-as-you-go pricing as the business grows. IT professionals might be looking for a simplified interface and centralized management to make monitoring and reporting more efficient.

When comparing different cloud solutions for object storage, there are a few more questions to ask before making a purchase:

• Is there a web-based admin console? A web-based admin console makes it easy to view backups from multiple servers. You can manage all your storage from one single location and download or recover files from anywhere in the world with a network connection.
• Are there multiple ways to interact with the storage? Does the provider offer different ways to access your data, for example, via a web console, APIs, CLI, etc.? If your infrastructure is configured to work with the S3 API, does the provider offer S3 compatibility?
• Can you set retention? Some industries are more highly regulated than others. Consider whether your company needs a certain retention policy and ensure that your cloud storage provider doesn’t unnecessarily charge minimum file retention fees.
• Is there native application support? A native environment can be helpful to back up an Exchange and SQL Server appropriately, especially for team members who are less experienced in cloud storage.
• What types of restores does it offer? Another crucial factor to consider is how you can recover your data from cloud storage, if necessary.

Making a Buying Decision: The Intangibles

Lastly, don’t just consider the individual software and cloud storage solutions you’re buying. You should also consider the company you’re buying from. It’s worth doing your due diligence when vetting a cloud storage provider. Here are some areas to consider:

Stability

When it comes to crucial business data, you need to choose a company with a long-standing reputation for stability.

Data loss can happen if a not-so-well-known cloud provider suddenly goes down for good. And some lesser-known providers may not offer the same quality of uptime, storage, and other security and customer support options.

Find out how long the company has been providing cloud storage services, and do a little research to find out how popular its cloud services are.

Customers

Next, take a look at the organizations that use their cloud storage backup solutions. Do they work with companies similar to yours? Are there industry-specific features that can boost your business?

Choosing a cloud storage company that can provide the specs that your business requires plays an important role in the overall success of your organization. By looking at the other customers that a cloud storage company works with, you can better understand whether or not the solution will meet your needs.

Reviews

Online reviews are a great way to see how users respond to a cloud storage product’s features and benefits before trying it out yourself.

Many software review websites such as G2, Gartner Peer Insights, and Capterra offer a comprehensive overview of different cloud storage products and reviews from real customers. You can also take a look at the company’s website for case studies with companies like yours.

Values

Another area to investigate when choosing a cloud storage provider is the company values.

Organizations typically work with other companies that mirror their values and enhance their ability to put them into action. Choosing a cloud storage provider with the correct values can help you reach new clients. But choosing a provider with values that don’t align with your organization can turn customers away.

Many tech companies are proud of their values, so it’s easy to get a feel for what they stand for by checking out their social media feeds, about pages, and reviews from people who work there.

Continuous Improvement

An organization’s ability to improve over time shows resiliency, an eye for innovation, and the ability to deliver high-quality products to users like you. You can find out if a cloud storage provider has a good track record for improving and innovating their products by performing a search query for new products and features, new offerings, additional options, and industry recognition.

Keep each of the above factors in mind when choosing a server backup solution for your needs.

How Cloud Storage Can Protect Servers and Critical Business Data

Businesses have already made huge progress in moving to the cloud to enable digital transformations. Cloud-based solutions can help businesses modernize server backup solutions or adopt hybrid cloud strategies. To summarize, here are a few things to remember when considering a cloud storage solution for your server backup needs:

• Understand the pros and cons of on-premises backup solutions and consider a hybrid cloud approach to storing backups.
• Evaluate a provider’s cost, security offerings, integrations, and support structure.
• Consider intangible factors like reputation, reviews, and values.

Have more questions about cloud storage or how to implement cloud backups for your server? Let us know in the comments. Ready to get started? Your first 10GB are free.

The post Server Backup 101: Choosing a Server Backup Solution appeared first on Backblaze Blog | Cloud Storage & Cloud Backup.

Post Syndicated from Kari Rivas original https://www.backblaze.com/blog/whats-the-diff-file-level-vs-block-level-incremental-backups/

If you’ve stumbled upon this blog, chances are you already know that you need to be backing up your data to protect your home or business. Maybe you’re a hobbyist with over 1,000 digital movies in your collection and you lie awake at night, worrying about what would happen if your toddler spills juice on your NAS (let’s face it, toddlers are data disasters waiting to happen). Or you’re a media and entertainment professional worried about keeping archives of your past projects on an on-premises device. Or maybe that tornado that hit your area last week caused you to think twice about keeping all of your data on-premises.

Whether you have a background in IT or not, the many different configuration options for your backup software and cloud storage can be confusing. Today, we’re hoping to clear up one common question when it comes to backup strategies—understanding the difference between file-level and block-level incremental backups.

What’s the Diff: File-level vs. Block-level Incremental Backups

Let’s take it to the next level. Incremental backups back up what has been changed or added since your last full backup. Within the category of incremental backups, there are two standard options: file-level and block-level incremental backups. Many backup tools and devices, like network attached storage (NAS) devices, offer these options in the configuration settings, so it’s important to understand the difference. After you decide which type of incremental backup is best for you, check your backup software or device’s support articles to see if you can configure this setting for yourself.

File-level Incremental Backups

When a file-level incremental backup is performed and a file has been modified, the entire file is copied to your backup repository. This takes longer than performing a block-level backup because your backup software will scan all your files to see which ones have changed since the last full backup and will then back up the entire modified file again.

Imagine that you have a really big file and you make one small change to that file; with file-level backups, the whole file is re-uploaded. This likely sounds pretty inefficient, but there are some advantages to a file-level backup:

• It’s simple and straightforward.
• It allows you to pick and choose the files you want backed up.
• You can include or exclude certain file types or easily back up specific directories.

File-level backups might be the right choice for you if you’re a home techie who wants to back up their movie collection, knowing that those files are not likely to change. Or it could be a good fit for a small business with a small amount of data that isn’t frequently modified.

The diagram below illustrates this concept. This person performs their full backup on Sundays and Wednesdays. (To be clear, we’re not recommending this cadence—it’s just for demonstration purposes.) This results in a 100% copy of their data to a backup repository like Backblaze B2 Cloud Storage. On Monday, part of a file is changed (the black triangle) and a new file is added (the red square). The file-level incremental backup uploads the new file (the red square) and the entire file that has changed (the grey square with the black triangle). On Tuesday, another file is changed (the purple triangle). When the file-level incremental backup is performed, it adds the entire file (the grey square with the purple triangle) to the backup repository. On Wednesday, a new full backup is run, which creates a complete copy of the source data (including all your previously changed and added data) and stores that in the cloud. This starts the cycle of full backups to incremental backups over again.

Block-level Incremental Backups

Block-level incremental backups do not copy the entire file if only a portion of it has changed. With this option, only the changed part of the file is sent to the backup repository. Because of this, block-level backups are faster and require less storage space. If you’re backing up to cloud storage, obviously this will help you save on storage costs.

Let’s return to our scenario where full backups are performed on Sundays and Wednesdays, but this time, block-level incrementals are being run in between. When the first block-level incremental backup is run on Monday, the backup software copies just the changed piece of data in the file (the black triangle) and the new data (the red square). In the Tuesday backup, the additional modified data in another file (the purple triangle) is also added to the backup repository. On Wednesday, the new full backup results in a fresh copy of the full data set to the cloud.

Block-level incremental backups take a snapshot of the running volume and data is read from the snapshot. This allows files to be copied even if they’re currently in use in a running software program, and it also reduces the impact on your machine’s performance while the backup is running.

This backup type works better than file-level incremental backups when you have a large number of files or files that often change. If you don’t need to pick and choose which files to specifically include or exclude in your backup, it’s generally best to use block-level incremental backups, as they’re more efficient.

The only drawbacks to block-level incremental backups are that recovery may take longer, since your backup software will need to recover each piece of modified data and rebuild the file. And, because this style of incremental backup uploads modified data in pieces and parts, if one of those pieces becomes corrupted or is unable to be recovered, it could affect your ability to recover the whole file. For this reason (and plenty of other good reasons), it’s important to regularly include full backups in your backup strategy and not just count on incremental backups perpetually.

Ready to Get Started?

No matter which method of incremental backup you decide is right for you, you can take advantage of Backblaze’s extremely affordable B2 Cloud Storage at just $5/TB/month. Back up your servers or your NAS in a matter of minutes and enjoy the peace of mind that comes with knowing you’re protected from a data disaster.

The post What’s the Diff: File-level vs. Block-level Incremental Backups appeared first on Backblaze Blog | Cloud Storage & Cloud Backup.

Post Syndicated from Molly Clancy original https://www.backblaze.com/blog/backup-solutions-for-medical-offices/

If you are responsible for the day-to-day maintenance of a medical office’s IT systems, including data backups, your job has never been more important. Since offices started shifting to electronic health records, managing IT systems for medical practices has presented a unique set of challenges—the amount of data you have to manage has grown, data is subject to HIPAA regulations, and recently, your data became even more of a target for cybercriminals as they zeroed in on health facilities over the course of the COVID-19 pandemic.

In 2020, 560 healthcare facilities were affected by ransomware according to a report by Emsisoft, a cybersecurity firm. Medical offices manage high volumes of personally identifiable information like social security numbers and patient data, and, as IT managers of medical offices can probably attest, they may not have the resources to afford dedicated cybersecurity staff, making them attractive to cybercriminals looking for vulnerable targets.

But, HIPAA requirements and cybersecurity aren’t the only reason to back up your medical practice’s data—your data is one of your most important assets and making sure it’s safe and accessible keeps your practice running smoothly.

Whether you outsource some of your IT tasks, like backups, to a managed service provider (MSP) or you manage everything in house with network attached storage (NAS) or other hardware, understanding backup best practices and the different cloud options available can help you make the best decisions to protect your important data.

In this guide for backing up medical offices, learn more about:

• Records retention.
• Backup strategies.
• Backing up NAS devices.
• Working with MSPs.

How Long Should a Medical Office Keep Records?

One of the first pieces of the puzzle to understand when planning your data backup strategy is how long you’ll need to keep medical records and the regulatory requirements that govern retention.

Unfortunately, there’s no standard timeline, and there are a lot of factors to consider. Each state has different rules and statute limitations. Some federal regulations apply as well. And different patients will fall under different guidelines—namely, you’ll probably want to retain records longer for minors. The easiest answer is to retain records for as long as the strictest rule applies.

Start to develop your retention policy by checking the state and federal regulations that may apply to your practice. The American Health Information Management Association provides a comprehensive guide on all of the state, federal, accreditation agency, and other regulations that apply to retention requirements here.

With all of these moving parts and an ever-growing data set, managing data storage for medical offices within budget can be a notorious balancing act. But, today, affordable cloud storage is making it easier for medical practices to establish much simpler and more robust retention strategies rather than fine-tuning and calibrating their strategies to manage data with limited on-premises resources.

What Is the HIPAA Regulation for Storage of Medical Records?

A common misconception is that HIPAA stipulates retention requirements for medical records. HIPAA does not govern how long medical records must be retained, but it does govern how long HIPAA-related documentation must be retained. Any HIPAA-related documentation, including things like policies, procedures, authorization forms, etc., must be retained for six years according to guidance in HIPAA policy § 164.316(b)(2)(i) on time limits. Some states may have longer or shorter retention periods. If your state’s period is shorter, HIPAA supersedes state regulations.

How Long Does a Medical Office Need to Keep Insurance EOBs?

Explanations of benefits, or EOBs, are documents from insurance providers that explain the amounts insurance providers will pay for services. Retention periods for these documents vary by state as well. Additionally, insurance providers may stipulate how long records must be kept.

The 3-2-1 Backup Strategy

If understanding how long you need to keep records is the first step in structuring your medical practice’s backup plan, the second is understanding what a good backup strategy looks like.

The 3-2-1 backup strategy is a tried and true method for protecting data. It means keeping at least three copies of your data on two different media (i.e. devices) with at least one off-site, generally in the cloud. For a medical office, we can use a simple X-ray file as an example. That file should live on two different devices on-premises, let’s say a machine reserved for storing X-rays which backs up to a NAS device. That’s two copies. If you then back up your NAS device to cloud storage, that’s your third, off-site copy.

The Benefits of Backing Up Your Medical Office

You might wonder why you need three copies. There are some compelling benefits that make a strong case for using a 3-2-1 strategy rather than hoping for the best with fewer copies of your data.

1. Fast access to files. When you accidentally delete a file, you can restore it quickly from either your on-site or cloud backup. And if you need a file while you’re away from your desk, you can simply log in to your cloud backup and access it immediately.
2. Quick recoveries from computer crashes. Keeping one copy on-site means you can quickly restore files if one of your machines crashes. You can start up another computer and get immediate access, or you can restore all of the files to a replacement computer.
3. Reliable recoveries from damage and disaster. Floods, fires, and other disasters do happen. With a copy off-site, your data is one less thing you have to worry about in that unfortunate event. You can access your files remotely if needed and restore them completely when you are able.
4. Safe recoveries from ransomware attacks. Keeping an off-site copy in the cloud, especially if you take advantage of features like Object Lock, can better prepare you to recover from a ransomware attack.
5. Compliance with regulatory requirements. As mentioned above, medical practices are subject to retention regulations. Using a cloud backup solution that offers AES encryption helps your practice achieve compliance.

What Are the HIPAA Regulations for Backups and Disaster Recovery?

The HIPAA Security Final Rule, which went into full effect in 2005, and the HITECH Act of 2009 outline specific requirements for how medical practices protect the privacy and security of patient information. The HIPAA text that applies to backups and disaster recovery can be found here and the HITECH Act can be found here. There are three main requirements:

1. Medical offices must have a data backup plan. The rule states that you must “maintain retrievable exact copies of electronic protected health information.”
2. Data at rest must be encrypted.
3. Medical offices must have a disaster recovery plan where data can be restored in a loss event.

You also need to document these procedures and test them regularly. Cloud backups help you achieve compliance with HIPAA and HITECH by keeping a copy of your data off-site while still retrievable.

Using NAS for Medical Offices

Many medical offices rely on NAS to manage their data on-site. NAS is essentially a computer connected to a network that provides file-based data storage services to other devices on the network. The primary strength of NAS is how simple it is to set up and deploy.

NAS is frequently the next step up for a small practice that is using external hard drives or direct attached storage, which can be especially vulnerable to drive failure. Moving up to NAS offers medical offices and independent practitioners a number of benefits, including:

• The ability to share files locally and remotely.
• 24/7 file availability.
• Data redundancy.
• Integrations with cloud storage that provides a location for necessary, automatic data backups.

If you’re interested in upgrading to NAS, check out our Complete NAS Guide for advice on provisioning the right NAS for your needs and getting the most out of it after you buy it.

Hybrid Cloud Strategy for Medical Practices: NAS + Cloud Storage

Most NAS devices come with cloud storage integrations that enable businesses to adopt a hybrid cloud strategy for their data. A hybrid cloud strategy uses a private cloud and public cloud in combination. To expand on that a bit, a hybrid cloud refers to a cloud environment made up of a mixture of typically on-premises, private cloud resources combined with third-party public cloud resources that use some kind of orchestration between them. In this case, your NAS device serves as the on-premises private cloud, as it’s dedicated to only you or your practice, and then you connect it to the public cloud.

Some cloud providers are already integrated with NAS systems. (Backblaze B2 Cloud Storage is integrated with NAS systems from Synology and QNAP, for example.) Check if your preferred NAS system is already integrated with a cloud storage provider to ensure setting up cloud backup, storage, and sync is as easy as possible.

Your NAS should come with a built-in backup manager, like Hyper Backup from Synology or Hybrid Backup Sync from QNAP. Once you download and install the appropriate backup manager app, you can configure it to send backups to your preferred cloud provider. You can also fine-tune the behavior of the backup jobs, including what gets backed up and how often.
Now, you can send backups to the cloud as a third, off-site backup and use your cloud instance to access files anywhere in the world with an internet connection.

Using an MSP for Medical Practices

Many medical practices choose to outsource some or all IT services to an MSP. Making the decision of whether or not to hire an MSP will depend on your individual circumstances and comfort level. Either way, coming to the conversation with an understanding of your backup needs and the cloud backup landscape can help.

When seeking out an MSP, make sure to ask about the cloud provider they’re using and how they charge for storage and data transfer. And if you’re not using an MSP, compare costs from different cloud providers to make sure you’re getting the most for your investment in backing up your data.

Cloud Storage and Your Medical Practice

Whether you’re managing your data infrastructure in house with NAS or other hardware, or you’re planning to outsource your IT needs to an MSP, cloud storage should be part of your backup strategy. To recap, having a third copy of your data off-site in the cloud gives you a number of benefits, including:

• Fast access to your files.
• Quick recoveries from computer crashes.
• Reliable recoveries from natural disasters and theft.
• Protection from ransomware.
• Compliance with HIPAA requirements and other federal and state regulations.

Have questions about choosing a cloud storage provider to back up your medical practice? Let us know in the comments. Ready to get started? Click here to get your first 10GB free with Backblaze B2.

The post Backup Solutions for Medical Offices appeared first on Backblaze Blog | Cloud Storage & Cloud Backup.

Post Syndicated from Kari Rivas original https://www.backblaze.com/blog/whats-the-diff-full-incremental-differential-and-synthetic-full-backups/

If you made your way here to the Backblaze blog, you probably understand the value of backing up your data. Data disasters, like ransomware attacks, floods, and fires, can easily cost a business thousands of dollars in recovery expenses. But whether you’re an IT professional or a small or medium-sized business owner, what you may not realize is that knowing you need to back up is just the first step.

Next, you have to think about what kind of backup strategy you should have in place. Specifically, there are four different types of backups that you need to consider:

• Full backups.
• Incremental backups.
• Synthetic full backups.
• Differential backups.

Some of our integration tools, like MSP360 and Veeam, let you configure the type of backup you want to perform, so it’s important to understand the difference. Choosing the right backup type also means maximizing efficiency, as simply performing a full backup of your data on a daily basis would take up too much bandwidth and storage, resulting in unnecessary extra costs.

Not sure what kind of backup you need to do? In this post, learn the differences and when each should be used.

First Things First: Full Backups

A full backup is the very first backup you create of your data. You start with nothing—no backup—and then you make a complete copy of your data. It will probably take a while, because you’re starting from nothing, making this your longest backup job.

Full Backup Pros and Cons

You can see how it would be time-consuming to do a full backup each time, right? Who has time for that? In the time you’re taking to do a full backup each day, you could be balancing your bank account, reorganizing your closet, or let’s be honest here, playing Wordle (guilty). Plus, you would likely need a lot of extra bandwidth and storage to be able to run a full backup everyday.

However, full backups are also the best option for recovery, because they contain all the files you need. Because your full backup is a clone of your data, it’s super important to encrypt them. Backblaze B2 Cloud Storage stores the data you put in it. You can choose to upload only encrypted data or use a third-party integration to encrypt data before transmission to Backblaze B2 Cloud Storage. We also support server-side encryption (SSE) using the 256-bit Advanced Encryption Standard (AES-256), with multiple key management options. Don’t forget this essential step!

You should think about how often to do your full backups, given that they are the safest recovery option but also the most time-consuming and expensive to complete. Some people do full backups daily; some do them weekly; and some complete them monthly, or even less often. It all depends on your backup strategy plan and how you balance your needs for data security vs. your resources, like time, funds, etc. For example, in the image below, this person has decided to do their full backup on a Sunday. Their source data is copied exactly as-is into the cloud. This provides them the security of a 100% true copy of their data.

TLDR Version:

• 100% true copy of data.
• Best for file restoration in terms of data fidelity.
• Expensive.
• Slow.

Now, Just the Changes: Incremental Backups

Once you have your full backup, you have a baseline for any subsequent backups. For reasons already explained, it’s probably not efficient for you to do a full backup each time. That’s where incremental backups come in.

Incremental backups copy the data that has changed or has been added since your last full backup and then, any newly changed or added data since the previous incremental backup. Now, there are two different types of incremental backups: file-level and block-level, but let’s keep things simple here and save that topic for a future blog post, shall we?

Let’s take a look at the image below. This person performs their full backups on Sundays and Wednesdays so that they always have a fairly recent complete copy of their data. Then, on the other days of the week, they perform incremental backups. (To be clear, we’re not recommending this cadence—it’s just for demonstration purposes.) Here’s a step-by-step overview of the process:

• Sunday: A full backup is created.
• Monday: After the full backup on Sunday, one file is changed (the purple triangle) and one new file is added (the red square). Both of these changes are uploaded to the backup repository in the cloud.
• Tuesday: An additional new file is created (the second red square). This one piece of new data is sent to the cloud. You can see how incremental backups are backing up only new or changed data one piece at a time.
• Wednesday: A new full backup is run, which creates a complete copy of the source data (including all your previously changed and added data) and stores that in the cloud. This starts the cycle of full backups to incremental backups over again.

Note that there is another consideration here—whether you want your full backups to overwrite your existing backup repository or whether you would like to keep the previous versions of your files for extra security. Keeping an archive of your previous versions takes up more space (and therefore costs more) but it can be helpful to have an archive for some length of time (called your “retention period”). On the other hand, some backup providers charge retention minimums where they continue to bill you for data deleted before a certain time frame—make sure to read the terms and conditions carefully so you’re not stuck paying for deleted backups. Again, this all differs according to your data security needs. Some people keep archives going back a month. Some may keep an archive for a full year’s worth of previous versions. It’s all up to you.

Incremental Backup Pros and Cons

In a disaster recovery scenario, your restore will consist of your full backup and all of the incremental backups you’ve made. If you’ve made a lot of changes to your data since your last full backup, your restore could take some time, as it progresses through this “chain” of incremental changes. In other words, if you are only doing full backups monthly or less often and you add or change a lot of data in between, your recovery will take a long time because the restore will first process your last full backup and then each piece of incrementally changed or added data.

Another downside is that your recovery could be compromised by any missing or damaged files, which would break your “chain” of backups and would make recovery of those files impossible. For this reason (and because having a fairly recent full backup is always a good idea), it’s important to do full backups regularly so you have a “fresh” full copy of your data to work from.

Determining how often and when to do your full backups, as well as deciding how many previous versions of your backups you want to keep, is a strategic decision that should take into consideration your typical operating conditions, your risk factors, your budget, and your time. For instance, you could perform a full backup on Sundays and incremental backups Monday-Saturday. Or, you may not even perform full backups as often as that; it’s important to think about your data and how often it changes.

TLDR Version:

• Takes up little space.
• Cost-saving.
• Slower recoveries.
• Corrupted files compromise the backup.

A Better Way: Synthetic Full Backups

We’ve already talked about the need to perform regular full backups, even if (and especially if) you’re using incremental backups. We’ve also discussed how regular full backups can be time-consuming. Synthetic full backups may give you the best of all worlds. They make use of incremental backups to create a more efficient full backup experience.

In a synthetic full backup, your backup software takes your previous full backup and all the incremental backups you’ve created over a set period of time and combines them into a new full, synthesized backup. Your new synthetic backup contains the same data as an active full backup. The only difference is how the new backup is created. Instead of copying your source data to create a new, full backup, the synthetic full backup includes the unchanged data from the source plus all the incremental backups of changed data.

In the diagram below, our hypothetical Backblaze customer performed a full backup on Sunday and an incremental backup on Monday and Tuesday. On Wednesday, their backup software performed a synthetic full backup by taking the previous backups from the backup repository and forging them into a new data set that is also a faithful copy of the source data. In other words, the synthetic full backup is completed in the cloud by merging the backups in the cloud, rather than referring to the source data.

Synthetic Full Backup Pros and Cons

Synthetic full backups are much faster than normal, active full backups. And because they contain a 100% copy of your data, they serve as the starting point for any subsequent incremental backups, thus resetting your backup chain.

Your backup software may have an option in your settings that needs to be turned on to enable synthetic full backups, so be sure to check out your tool’s help resources to locate this option. You will also be able to define when that synthetic full backup should be created. Put some thought into this, considering when and how often your data gets changed. Because your synthetic full backup is based on the interim incremental backups, it’s still somewhat at risk of being corrupted if one of the incremental backups is damaged.

However, since synthetic backups are much faster to create, you can regularly create new synthetic full backups to reduce that risk. For instance, let’s say you create your first full backup on Sunday. Then, Monday-Saturday you create incremental backups of your changed data. On the next Sunday, your system creates a synthetic full backup by combining the unchanged data from the first full backup plus all of the incremental backups completed during the week.

Ultimately, synthetic full backups allow you to create full backups more often, without hogging up precious bandwidth or storage space. And, having a full backup of your data is always the best way to protect your business from a data disaster.

Some of Backblaze’s integration partners support synthetic full backups, including MSP360 and Veeam, so be sure to check your backup tool’s help articles to see if this option is available to you.

TLDR Version:

• Less time-consuming.
• Saves on storage costs.
• Not as effective if lots of changes are made.
• Still relies on incremental backups.

A Specialized Solution: Differential Backups

There’s another kind of backup to be aware of. Differential backups are popular for database applications like Microsoft SQL but not used frequently otherwise. Differential backups look at the last full backup only, and they collect the changes from the full backup. As you make changes to your original data set (the one in the full backup), your differential backup grows.

In our visual below, the full backup takes place on a Sunday. Each time the differential backup runs, it “looks back” to the full backup to see what has changed from the original source data. Again, changes can be modified files (like our purple triangle) or new files (like our red squares). It adds these changes to the backup repository in a cumulative way, which means differential backups can grow to be quite large.

Differential Backup Pros and Cons

Like incremental backups, differential backups are much faster to perform than a full backup. To perform a recovery from a differential backup, you just need the full backup and the latest differential backup. So differential backup restores can be quite fast. But the overall differential backup can take up a large amount of storage space, as the changed files are uploaded to the backup repository until a new full backup is done. Hence, they don’t necessarily offer cost savings in the way of storage.

Lastly, differential backups are used so infrequently that they almost don’t merit mention here, but we wanted to include them to present a full picture of the different kinds of backups out there.

TLDR Version:

• Good solution for database applications like SQL.
• Faster recoveries.
• Not cost-effective.
• Requires regular full backups as a base.

As you can see, there is a lot to think about when developing your backup strategy. Backblaze is here to help and demystify the process. Learn more about our backup and archive solutions and get started with our free 10GB offer today.

The post What’s the Diff: Full, Incremental, Differential, and Synthetic Full Backups appeared first on Backblaze Blog | Cloud Storage & Cloud Backup.

Post Syndicated from Jeremy Milk original https://www.backblaze.com/blog/ransomware-takeaways-from-q4-2021/

Ransomware commanded attention from both the media and governments like never before in 2021. It was an unprecedented year of major breaches, astronomical ransom demands, and attacks on businesses of all sizes. And much of what stood out to us towards the end of the year was the seemingly heightened regulatory response to previous quarters’ developments.

New regulations are hopeful signs that people are taking the ransomware threat more seriously, but they’re not enough to stop ransomware operators just yet. If you’re in charge of managing company data, knowing the latest in ransomware developments can help guide the choices and actions you take to protect company assets. Here are five key takeaways based on what we saw over Q4 2021.

1. U.S. State Department Sweetened the Deal for Reporting Cybercrime.

In Q4, we learned that the U.S. State Department put $10 million bounties on two specific ransomware groups—DarkSide and Sodinokibi—as well as $5 million bounties on their affiliates. This follows a statement issued earlier in 2021 that offered $10 million bounties for information on any person who engages in cybercrime. The bounties have proven effective in the past, with the department paying out more than $200 million since 1984 to individuals who provided intelligence that helped address threats to U.S. security.

2. Cyber Insurers Are Taking a More Conservative Stance.

The rise in attacks in 2021 led to a rise in companies seeking out cyber insurance coverage if they hadn’t already, and subsequently, a rise in claims against cyber insurance policies. The cyber insurance dynamics are evolving in response, and companies may need to think about coverage differently. Lloyds of London, for example, will no longer cover losses stemming from nation-state-affiliated criminals, cyber warfare, and “retaliatory” cyber activity. Whether or not ransomware gangs will be fully accepted as nation-state attackers is still up for debate, but the truth is that the cybersecurity community understands that some big name groups are definitely operating in league with their particular locale’s government branches.

3. Governments Named Names.

Also in November, the Ukrainian Security Service disclosed the names and positions of five members of a major cybercrime syndicate. The disclosure revealed the members’ links to the Crimean branch of the Russian Federal Security Service (FSB). They furthermore released recorded telephone conversations where the members discussed attacks and griped about their FSB salaries. According to the Ukrainian Security Service, the group has heavily targeted the Ukrainian government in more than 5,000 cyberattacks. Despite these efforts to dox major players, the group has continued their attacks as tensions between Russia and Ukraine continue to escalate.

4. Sanctions Tightened Ransomware’s Vice Grip.

In October, a ransomware group linked to a sanctioned entity—Evil Corp—posted information allegedly stolen from the National Rifle Association (NRA). While the NRA has not confirmed the attack, if true, it would potentially put them between a rock and a hard place. If they pay the attackers, they could face penalties from the U.S. government.

The sanctions are also changing the behavior of ransomware groups. Sanctioned groups are less likely to be successful in getting victims to pay. One way they get around this is by creating subsidiary brands or spinoff entities that, to an unknowing victim, seem to be unaffiliated with the sanctioned entity. When victims are unaware of affiliations between groups, they’re more likely to pay ransoms and less likely to disclose attacks to the authorities. However, pleading innocence may not be enough for victims to avoid consequences should the attacks be discovered by authorities.

5. Players in the Ransomware Economy Came Under Fire.

The ransomware economy is a murky web of actors that includes entities beyond just the ransomware operators themselves. In December, researchers linked 15+ ransomware-related crypto exchanges to a single prestigious skyscraper in Moscow—the tallest in the city, in fact. The findings provide more fuel for security experts to argue that Russian authorities give ransomware gangs a wide berth.

What This Means for You

While Q4 saw increased scrutiny on some ransomware operations, stopping ransomware is like a game of Whac-A-Mole. When one group gets exposed or dissolved, the operators and resources just reemerge as a new brand. Ransomware isn’t going away anytime soon, and the stakes for companies who fall victim are only higher with new sanctions. All this makes investing in ransomware protection all the more necessary.

The post Ransomware Takeaways From Q4 2021 appeared first on Backblaze Blog | Cloud Storage & Cloud Backup.

Post Syndicated from Molly Clancy original https://www.backblaze.com/blog/backup-solutions-for-dentist-offices/

On top of providing excellent care to patients, dental practices today are tasked with the care of ever more complex IT solutions. Complying with regulations like HIPAA, protecting patient health records, and managing stores of data from X-rays to insurance information are among the demands that dental practices have to meet.

Whether you outsource these tasks to a managed service provider (MSP) or you manage your data infrastructure in house with network attached storage (NAS) or other hardware, understanding backup best practices and the different options available to help you manage your practice’s data is important for your continued success.

Keeping your data safe and accessible doesn’t have to be complicated or expensive. In this post, learn more about records retention for dental offices and how you can implement some simple strategies to keep data safe and protected, including 3-2-1 backups, common NAS devices, and insight from an MSP that specializes in IT services specifical for dental practices.

How Long Should a Dental Office Keep Records?

When thinking about backup and data storage solutions for your dental practice, it helps to first have a good understanding of the records retention requirements for dental offices. The best way to understand how long a dental office should keep records is to check with your state board of dentistry. Regulations on records retention vary by state and by patient type.

Retaining records for at least five to seven years is good practice, but some states will require longer retention periods of up to 10 years. Specific types of patients, including minors, may have different retention periods.

Regardless of your state regulations, records must be kept for five years for patients who receive Medicare or Medicaid. If your state regulations are less than five years, plan to retain records longer for these patients.

Finally, it’s good practice to keep all records for patients with whom you’re involved in any kind of legal dispute until the dispute is settled.

What Is the HIPAA Regulation for Storage of Dental Records?

HIPAA does not govern how long medical or dental records must be retained, but it does govern how long HIPAA-related documentation must be retained. Any HIPAA-related documentation, including things like policies, procedures, authorization forms, etc., must be retained for six years according to guidance in HIPAA policy § 164.316(b)(2)(i) on time limits. Some states may have longer or shorter retention periods. If shorter, HIPAA supersedes state regulations.

How Long Does a Dental Office Need to Keep Insurance EOBs?

Explanations of benefits or EOBs are documents from insurance providers that explain the amounts insurance will pay for services. Retention periods for these documents vary by state as well, so check with your state dental board to see how long you should keep them. Additionally, insurance providers may stipulate how long records must be kept. As a general rule of thumb, the longer retention period supersedes others. The best advice—err on the side of caution and keep records for the longest retention period required by either state or federal law. Fortunately, cloud storage provides you with a simple, affordable way to ensure your retention periods meet or exceed requirements.

3-2-1 Backup Strategy

Understanding how long you need to keep records is the first step in structuring your dental practice’s backup plan. The second is understanding what a good backup strategy looks like. The 3-2-1 backup strategy is a tried and true method for protecting data. It means keeping at least three copies of your data on two different media (i.e. devices) with at least one off-site, generally in the cloud. For a dental practice, we can use a simple X-ray file as an example. That file should live on two different devices on-premises, let’s say a machine reserved for storing X-rays which backs up to a NAS device. That’s two copies. If you then back your NAS device up to cloud storage, that’s your third, off-site copy.

The Benefits of Backing Up Your Dental Practice

Why do you need that many copies, you might ask. There are some tried and true benefits that make a strong case for using a 3-2-1 strategy rather than hoping for the best with fewer copies of your data.

1. Fast access to files. When you accidentally delete a file, you can restore it quickly from either your on-site or cloud backup. And if you need a file while you’re away from your desk, you can simply log in to your cloud backup and access it immediately.
2. Quick recoveries from computer crashes. Keeping one copy on-site means you can quickly restore files if one of your machines crashes. You can start up another computer and get immediate access, or you can restore all of the files to a replacement computer.
3. Reliable recoveries from damage and disaster. Floods, fires, and other disasters do happen. With a copy off-site, your data is one less thing you have to worry about in that unfortunate event. You can access your files remotely if needed and restore them completely when you are able.
4. Safe recoveries from ransomware attacks. After hearing about so many major ransomware attacks in the news this past year, you might be surprised to know that most attacks are carried out on small to medium-sized businesses. Keeping an off-site copy in the cloud, especially if you take advantage of features like Object Lock, can better prepare you to recover from a ransomware attack.
5. Compliance with regulatory requirements. As mentioned above, dental practices are subject to retention regulations. Using a cloud backup solution that offers AES encryption helps your practice achieve compliance.

Using NAS for Dental Practices

NAS is essentially a computer connected to a network that provides file-based data storage services to other devices on the network. The primary strength of NAS is how simple it is to set up and deploy.

NAS is frequently the next step up for a small business that is using external hard drives or direct attached storage, which can be especially vulnerable to drive failure. Moving up to NAS offers businesses like dental practices a number of benefits, including:

• The ability to share files locally and remotely.
• 24/7 file availability.
• Data redundancy.
• Integrations with cloud storage that provides a location for necessary automatic data backups.

If you’re interested in upgrading to NAS, check out our Complete NAS Guide for advice on provisioning the right NAS for your needs and getting the most out of it after you buy it.

Hybrid Cloud Strategy for Dental Practices: NAS + Cloud Storage

Most NAS devices come with cloud storage integrations that enable businesses to adopt a hybrid cloud strategy for their data. A hybrid cloud strategy uses a private cloud and public cloud in combination. To expand on that a bit, a hybrid cloud refers to a cloud environment made up of a mixture of typically on-premises, private cloud resources combined with third-party public cloud resources that use some kind of orchestration between them. In this case, your NAS device serves as the on-premises private cloud, as it’s dedicated to only you or your organization, and then you connect it to the public cloud.

Some cloud providers are already integrated with NAS systems. (Backblaze B2 Cloud Storage is integrated with NAS systems from Synology and QNAP, for example.) Check if your preferred NAS system is already integrated with a cloud storage provider to ensure setting up cloud backup, storage, and sync is as easy as possible.

Your NAS should come with a built-in backup manager, like Hyper Backup from Synology or Hybrid Backup Sync from QNAP. Once you download and install the appropriate backup manager app, you can configure it to send backups to your preferred cloud provider. You can also fine-tune the behavior of the backup jobs, including what gets backed up and how often.

Now, you can send backups to the cloud as a third, off-site backup and use your cloud instance to access files anywhere in the world with an internet connection.

Using an MSP for Dental Practices

Many dental practices choose to outsource some or all IT services to an MSP. Making the decision of whether or not to hire an MSP will depend on your individual circumstances and comfort level. Either way, coming to the conversation with an understanding of your backup needs and the cloud backup landscape can help.

Nate Smith, Technical Project Manager at DTC, is responsible for backing up 6,000+ endpoints on 500+ servers at more than 450 dental and doctor’s offices in the mid-Atlantic region. He explained that, due to the sheer number of objects most dentists need to restore (e.g., hundreds of thousands of X-rays), the cost of certain cloud providers can be prohibitive. “If you need something and you need it fast, Amazon Glacier will hit you hard,” he said, referring to the service’s warming fees and retrieval costs.

When seeking out an MSP, make sure to ask about the cloud provider they’re using and how they charge for storage and data transfer. And if you’re not using an MSP, compare costs from different cloud providers to make sure you’re getting the most for your investment in backing up your data.

Cloud Storage and Your Dental Practice

Whether you’re managing your data infrastructure in house with NAS or other hardware, or you’re planning to outsource your IT needs to an MSP, cloud storage should be part of your backup strategy. To recap, having a third copy of your data off-site in the cloud gives you a number of benefits, including:

• Fast access to your files.
• Quick recoveries from computer crashes.
• Reliable recoveries from natural disasters and theft.
• Protection from ransomware.
• Compliance with regulatory requirements.

Have questions about choosing a cloud storage provider to back up your dental practice? Let us know in the comments. Ready to get started? Click here to get your first 10GB free with Backblaze B2.

The post Backup Solutions for Dentist Offices appeared first on Backblaze Blog | Cloud Storage & Cloud Backup.

Post Syndicated from Molly Clancy original https://www.backblaze.com/blog/testing-your-ransomware-readiness/

Every eleven seconds. That’s how frequently ransomware attacks were predicted to happen this year according to Cybersecurity Ventures. And if U.S. Treasury predictions are correct, the payouts from those attacks will exceed a billion dollars by the end of the year.

Despite taking steps to be better prepared, many companies still end up paying ransoms because the cost of extended downtime to restore from backups with limited resources exceeds the ransom demand. Even then, assuming the decryption key even works, there’s no reason to assume threat actors won’t make additional modifications, leave backdoors they can exploit again, or use exfiltrated data against you.

But, you don’t have to let that be your story. Today, we’re explaining the reasons for testing your security stance, different testing strategies and best practices including penetration testing and recovery testing, and steps you can take to develop a testing protocol.

Ransomware is on the rise. Level up your security practices along with it.

First, Implement a Strong Backup Practice

Backups are a critical piece of your ransomware defense strategy. Before thinking about testing, take the time to shore up your ransomware defenses by implementing at least a 3-2-1 backup strategy, if not a more comprehensive strategy like 3-2-1-1-0 or 4-3-2.

If you’re unfamiliar with these strategies, they advise keeping at least three copies of your data on two different media with at least one off-site. Strategies like 3-2-1-1-0 and 4-3-2 go a step further, advising you to keep a copy offline or protected by Object Lock, ensure your data has zero errors, and/or keeping additional backup copies for good measure.

Ransomware Readiness Resources

The National Cybersecurity Center of Excellence (NCCoE), a part of the National Institute of Standards and Technology (NIST), publishes a set of guidelines that support the development of secure information systems. These controls cover operational, technical, and management practices for information security teams, including:

• How to identify and protect assets against ransomware.
• How to detect and respond to ransomware incidents.
• Recommended controls to mitigate ransomware risk.
• Guidelines for cybersecurity event recovery.

The Cybersecurity and Infrastructure Agency (CISA) also offers a module, the Cybersecurity Evaluation Tool, that guides network administrators through a process to evaluate the cybersecurity practices on their networks. When it comes to evaluating your cybersecurity defensive stance, these resources are a good place to start.

Why Test Your Ransomware Defenses?

Weathering a ransomware incident depends on how prepared you are before the attack. First, by establishing a solid backup strategy. Second, by analyzing your vulnerabilities in a penetration test. And third, by testing recovery procedures to prepare and familiarize your team with your defense systems and your recovery plans. While there are many, the biggest reasons for testing your ransomware defenses include:

1. Shifting threats: Cybersecurity threats are always evolving and changing. Regularly evaluating potential vulnerabilities and testing your recovery practices prepares you for unforeseen situations.
2. Compliance: Companies in certain industries are required to show proof of vulnerability assessments and recovery testing in order to comply with regulations.
3. Creating a culture of preparedness: Familiarizing your staff with testing and recovery procedures better prepares them if the real thing happens. In the moment, they’ll know exactly what to do.
4. Prioritizing budgets: Identifying threats and potential vulnerabilities helps your team prioritize spending around the most mission critical efforts to protect your company.

Maybe your backup system is functioning well, but the effort to test recovery scenarios or analyze your environment for vulnerabilities is lower priority than day-to-day demands. Or maybe you’ve looked into vulnerability testing or recovery planning, but it’s out of scope for your organization—you may not need enterprise-scale solutions.

Either way, if you need any more justification to implement a vulnerability testing program or recovery solution, look no further than the many companies scrambling to respond to the Log4j vulnerability. A security engineer from a major software company explained it well in a WIRED article, “Security-mature organizations will start trying to assess their exposure within hours of an exploit like this, but some organizations will take a few weeks, and some will never look at it.” Any amount of time you can spend on preparation brings you that much closer to security maturity.

Testing Your Cybersecurity Readiness

Two security practices that security-mature organizations regularly undertake include penetration testing and disaster recovery testing. When thinking about your overall cybersecurity readiness, it helps to have an understanding of these key practices.

What Is Penetration Testing?

Penetration testing or pen testing is a broad term that covers many different levels of testing from phishing assessments, to vulnerability identification, to full on adversarial hacking simulations. Most organizations will choose to work with an outside consultant to conduct penetration testing and will scope out the depth and breadth of the testing procedures. Ideally, you want to work with someone with little or no knowledge of your systems so they can uncover vulnerabilities you might not see.

Those vulnerabilities are the output of a pen test, and they help organizations identify and prioritize steps to address in order to implement security upgrades.

What Is Disaster Recovery Testing?

Disaster recovery testing involves going through a simulated recovery scenario to make sure you can recover quickly and completely from backups. In the event of a ransomware attack or identification of a breach, the last thing you want is chaos. Regularly testing your recovery protocols helps you and your team build familiarity with the procedures. If you ever are attacked by ransomware, you’ll be much more comfortable knowing exactly what to do to bring your systems safely back up.

The Testing Process

Whether you’re approaching a pen test or a recovery test, the overall steps in the process are generally similar:

1. Design test objectives: Testing consumes time and resources, so it is essential to be thoughtful about what exactly you decide to test. If you are new to cybersecurity testing, you might find it helpful to start by running a simple small-scale test. At a minimum, define the business function you’re testing, the test duration, test method, the test objective, and any secondary objectives.
2. Execute the test: Make early decisions about execution, including when you’ll conduct the test, if the test will interrupt production, and whether you’ll make employees aware of the test. There are pros and cons to most execution methods, so it really depends on your overall objectives.
3. Analyze test results: When analyzing test results, identify both technical issues and business impacts. Did the process substantially disrupt production resulting in extensive downtime? How can you work to minimize that business impact?
4. Implement continuous improvements: If you find gaps in your process during testing, celebrate that fact. You now know where you need to boost defenses or strengthen your recovery protocol before a real attack comes along. Generally speaking, focus your continuous improvement efforts on two principles: impact and likelihood. For example, a vulnerability capable of taking your payment system offline would have a high impact. If that vulnerability is also highly likely, addressing this issue may be a top priority.
5. Schedule the next test: In IT security, there is no such thing as “done” because threats are constantly evolving. Tomorrow’s threats may require different safeguards. That’s why experts advise conducting annual testing of cybersecurity programs and recovery procedures as a starting point.

You Can Reduce Your Security Risk

By using regular testing and continuous improvement, you can reduce the likelihood of a severe IT security incident. Of course, there are other ways you can enhance your safeguards. If you’re looking for more detailed information on ransomware and how to protect data, identify threats, and recover from an attack, download our Complete Guide to Ransomware.

The post Testing Your Ransomware Readiness appeared first on Backblaze Blog | Cloud Storage & Cloud Backup.