Backups alone no guar­an­tee of recov­ery

IMAGINE a typ­ical work­day sud­denly unrav­el­ling. A crit­ical sys­tem goes down, employ­ees are locked out, cus­tomer orders stall and phones begin ringing incess­antly. Amid the chaos, someone offers reas­sur­ance: “It’s fine, we have backups.”

That reas­sur­ance, however, can be dan­ger­ously mis­lead­ing.

Exa­bytes chief oper­at­ing officer Guan Tian Lai said many organ­isa­tions con­flate hav­ing backups with being able to recover.

“Backups only tell you that a copy of your data exists. They do not guar­an­tee that your busi­ness can resume oper­a­tions within an accept­able time or with min­imal dis­rup­tion.”

A False Sense of Security

World Backup Day, marked on March 31, serves as a timely reminder for organ­isa­tions to safe­guard their data. But stop­ping at backups alone can cre­ate a false sense of secur­ity.

Guan said the more import­ant ques­tion organ­isa­tions should ask is not whether data is backed up, but whether sys­tems, ser­vices and work­flows can be restored when it mat­ters most.

“We often see busi­nesses assume they are pre­pared simply because backups are in place. In real­ity, dis­aster recov­ery is about restor­ing the entire envir­on­ment — access, applic­a­tions, depend­en­cies — not just files.”

Many organ­isa­tions only dis­cover gaps in their recov­ery strategy when dis­rup­tion strikes. Incid­ents can stem from human error, mis­con­fig­ur­a­tion, cre­den­tial com­prom­ise or ser­vice pro­vider out­ages — all of which are increas­ingly com­mon in Malay­sia’s digital land­scape.

This con­cern is echoed by the Malay­sia Com­puter Emer­gency Response Team (MyCERT), which has repor­ted a rise in ransom­ware-related incid­ents in early 2026, high­light­ing the grow­ing soph­ist­ic­a­tion of cyber threats.

Understanding What Really Matters

At its core, backup is about data stor­age, while dis­aster recov­ery is about busi­ness con­tinu­ity.

Two key bench­marks define this cap­ab­il­ity: Recov­ery Time Object­ive (RTO) and Recov­ery Point Object­ive (RPO). Guan stressed that these are busi­ness-driven decisions rather than purely tech­nical con­sid­er­a­tions.

“RTO and RPO define what the busi­ness can tol­er­ate. How long can you afford to be down? How much data can you afford to lose? Without clear answers, recov­ery becomes guess­work,” said Guan.

He added that organ­isa­tions that fail to define or test these tar­gets risk pro­longed out­ages des­pite hav­ing backups in place.

When Backups Fall Short

In real-world incid­ents, fail­ures rarely occur because backup files are miss­ing. Instead, they arise from gaps in exe­cu­tion and plan­ning.

Guan said that one of the most com­mon issues is the lack of res­tor­a­tion test­ing.

“Many teams mon­itor backup com­ple­tion but never test whether those backups can be restored quickly and cor­rectly. This cre­ates a false sense of con­fid­ence.”

Depend­en­cies fur­ther com­plic­ate recov­ery. Restor­ing a data­base alone is insuf­fi­cient if sup­port­ing sys­tems such as iden­tity ser­vices, DNS and net­work con­fig­ur­a­tions are not brought back in the cor­rect order.

“Recov­ery is not a single action. It is a sequence. If you restore com­pon­ents out of order or over­look depend­en­cies, the sys­tem may not func­tion even if the data is intact,” he added.

Separating Backup from Recovery

Guan said one of the most over­looked risks is the lack of sep­ar­a­tion between pro­duc­tion and backup envir­on­ments.

“Many organ­isa­tions believe they are pro­tec­ted because their backups are stored off­s­ite. But if the same cre­den­tials con­trol both pro­duc­tion and backup sys­tems, attack­ers can com­prom­ise recov­ery just as eas­ily.”

He said that in such scen­arios, attack­ers do not need to des­troy backups to cause dis­rup­tion.

“They can simply block access or delete backup sets using com­prom­ised cre­den­tials. The weak­ness is not the loc­a­tion of the backup, but the lack of sep­ar­a­tion in access con­trol.”

From Theory To Practice

To build genu­ine resi­li­ence, organ­isa­tions must adopt a more struc­tured and prac­tical approach to recov­ery.

Guan emphas­ised the need to identify Tier 1 sys­tems — the crit­ical com­pon­ents required to restore oper­a­tions.

“Iden­tity and access sys­tems should come first, fol­lowed by net­work ser­vices such as DNS, before mov­ing on to core busi­ness applic­a­tions. Without these found­a­tions, recov­ery becomes sig­ni­fic­antly more dif­fi­cult,” he said.

He also stressed the import­ance of defin­ing real­istic RTO and RPO tar­gets for each sys­tem, as well as ensur­ing backups are pro­tec­ted from tam­per­ing and sup­por­ted by mul­tiple recov­ery points.

Equally import­ant is the cre­ation of a clear run­book to guide teams dur­ing incid­ents.

“A good run­book defines who makes decisions, who leads recov­ery, what gets restored first and how com­mu­nic­a­tion is handled. In a crisis, clar­ity is everything,” he said.

A Shift in Mindset

While World Backup Day high­lights the import­ance of safe­guard­ing data, Guan said organ­isa­tions must move bey­ond basic meas­ures.

“Backups are neces­sary, but they are not suf­fi­cient. What mat­ters is whether you can recover quickly, safely and pre­dict­ably.”

*Full article from New Straits Times.