Choosing backup and recovery software

What it is

Backup and recovery tools copy your data and systems somewhere safe so you can restore them after a mistake, a hardware failure, a ransomware attack or a site outage. The backup is the easy part. The real measure is whether you can restore the right data, quickly enough, when something has gone wrong.

The main product types:

• Server and virtual machine backup protects on-premises and cloud servers, usually with image-level backups that can restore an entire system.
• Endpoint backup protects laptops and desktops, which matters when people store work locally or travel.
• SaaS backup protects data in services such as Microsoft 365 and Google Workspace. These providers keep your service running, but their built-in retention and recycle bins are not designed as a full backup, and deleted or encrypted data can age out.
• Immutable and offsite storage keeps copies that cannot be changed or deleted for a set period, even by an administrator account. This is the main defense against attackers who try to destroy backups before encrypting production.
• Disaster recovery (DR) goes beyond restoring files: it brings whole systems back up, sometimes in a secondary site or cloud, with documented failover steps.

Two terms drive every design decision. The recovery point objective (RPO) is how much data you can afford to lose, measured in time. The recovery time objective (RTO) is how long you can afford to be down.

Signs you need it

• You cannot say when a full restore was last tested, or the last test failed.
• Your backups live on the same network, domain or credentials as the systems they protect.
• You assume your SaaS provider backs up your email and files for you.
• Someone deleted a shared folder or mailbox and recovery took days or did not work.
• A cyber insurance application or customer asked about immutable or offline backups and you were not sure how to answer.
• Your business owners have never agreed on how long each system can be down.

What to look for

• Coverage of everything you run. Servers, endpoints, databases and SaaS often need different tools, and gaps tend to hide between them.
• Immutability that admins cannot override. Ransomware operators target backup consoles, so protection must survive a compromised administrator account.
• Separate credentials and multi-factor authentication on the backup system. The backup environment should not fall when your main directory does.
• Restore speed and granularity. Check how quickly you can restore a single file, a mailbox and a whole server, since each matters in different incidents.
• Malware and anomaly checks. Detecting unusual changes or scanning restore points helps you avoid restoring an infected copy.
• Clear alerts and reporting. Failed jobs that nobody notices are one of the most common reasons backups fail when needed.
• Retention you can set by policy. Legal, regulatory and contractual retention requirements differ by data type.

Mistakes to avoid

• Never testing restores. A backup you have not restored is an assumption, not a plan.
• Joining backup servers to the main domain or reusing administrator passwords, which hands attackers a path to your last line of defense.
• Keeping only short retention. Attackers can sit in a network for a while, and you may need a restore point from before they arrived.
• Backing up data but not documenting how to rebuild systems, including the order to restore them in and who does what.
• Ignoring SaaS data until someone needs a deleted mailbox back.
• Letting backup storage costs, rather than business needs, decide your RPO and RTO.

Questions to ask vendors

• How is immutability enforced, and can anyone, including your support staff, shorten or remove it?
• What happens to our backups if our administrator account or identity provider is compromised?
• How long does a typical full server restore take from your offsite or cloud copy?
• Which Microsoft 365 or Google Workspace data types do you back up, and which do you not?
• How do you help us confirm a restore point is clean before we restore it?
• How do we test restores without disrupting production?
• How are failed jobs reported, and to whom?
• If we leave, how do we get our backup data out?

What drives the cost

Cost depends on how much data you protect, how long you keep it, how many copies you hold and where they sit. Per-device or per-user licensing is common for endpoints and SaaS, while servers are often priced by workload or by storage consumed. Immutable and cloud storage adds ongoing charges, and restoring large amounts of data from some cloud storage can cost extra. Shorter RPO and RTO targets need more frequent backups, faster storage or standby systems, which all raise costs. Do not overlook effort: someone needs to watch job reports, run restore tests on a schedule and keep the recovery runbook current as systems change.

Where Tabor Point can help

Tabor Point offers cybersecurity audits, which include a review of your backups and whether they would survive a ransomware attack, and incident response if something does go wrong. An audit can show where your recovery plan has gaps before you choose a tool. If you want a second opinion before you buy, Tabor Point can help.