Preparatory Work
Despite many security measures taken, universities cannot fully protect themselves against any disaster, as recent cyberattacks on university sites have shown. Comprehensive data protection therefore also includes the best possible preparation for the "worst case". In order to ensure that university operations can be resumed as quickly as possible after an incident and that data backed up via DaSi.nrw can be restored effectively and efficiently, certain precautions must be taken. To support the consortium partners, a handout was developed that differentiates between possible damage scenarios and specifies concrete measures to prepare for recovery. In addition to organizational requirements, it also highlights technical circumstances that each university should consider to ensure secure data recovery.
You can view the mentioned handouts with the measures for recovery after a data loss here or in the download area.
Types of data loss
Loss in parts
Loss of part of data can occur in several ways. Accidental deletion is a good example of loss of a portion of data. The reason for data loss may be trivial, but the impact of important operational data (e.g., from university administration or teaching) is not at all. If the case arises that it is not (anymore) possible to create local versions or snapshots, data can be restored on directory or file level. The prerequisite for this is the appropriate backup in advance.
The self-service of the data backup infrastructure helps to counteract the loss of data. Via a self-service interface, users can remedy cases like these (so-called "standard changes") on their own. The failure of hardware such as local hard disks can also lead to data loss, which does not immediately mean collateral damage. Here, it is generally worthwhile to rely on redundant storage systems, i.e., storage that is located in multiple places. Regardless of how data is lost or to what extent, it is all the more important to back up data continuously as a precautionary measure.
Complete loss
In the case of a complete loss of data, the consequences are more far-reaching and the recovery more complex, depending on the system backed up. Complete loss of data is often the result of targeted destruction by cyberattacks. Software and application errors as well as physical destruction can also result in the complete loss of data. For example, fires or severe weather disasters can cause damage to the hardware being backed up and data inventories cannot be restored despite backups unless redundant, i.e. distributed, backups are made.
For moderate data volumes, the data backup infrastructure should be able to restore the previously backed up data to replacement devices. A platform-independent restore is of great advantage here. Users can restore their data on different platforms - even if they change systems.
Larger systems, however, which hold more than 10 TB of data and lose it in the event of damage, cannot be restored in a reasonable amount of time. However, in order to continue operations, it is important that the infrastructure offers an immediate restart. Virtual resources are provided on the data protection infrastructure for this purpose. In conjunction with the appropriate software solution, the backed up data can be started on a virtual machine. In this way, the IT-based ability to act of the affected institution can be restored even in the event of a disaster.
In the event of targeted attacks, for example by malware, the data backup infrastructure must be isolated as far as possible from the end devices. By ensuring that the locations of the infrastructure are well distributed, the impact of the malware can be minimized or even avoided. The same applies to attacks on the data protection infrastructure.