How to Ensure Data Integrity in Backups

Dear IT Auditors, Database Audit and Backup Integrity Review Backups are the safety net of every organization. When systems fail, backups restore business continuity. But when backups fail, recovery turns into chaos. That’s why auditing database backup integrity is one of the most critical parts of an IT and cybersecurity audit. 📌 Understand the Backup Strategy Start by reviewing the database backup policy. It should define what gets backed up, how often, and where backups are stored. Full, differential, and transaction log backups must all align with recovery objectives (RPOs and RTOs). A policy without alignment to business needs is only a document, not a safeguard. 📌 Backup Frequency and Coverage Confirm that backups are performed as scheduled. Review logs or reports from backup tools to ensure all critical databases, production, development, and test (if needed) are covered. Missed or outdated backups can lead to permanent data loss. 📌 Offsite and Cloud Storage Evaluate where backups are stored. Offsite or cloud backups add resilience against local disasters, but they must be encrypted and protected with strict access controls. Unsecured cloud backups have caused some of the most publicized breaches in recent years. 📌 Encryption and Data Protection Ensure that backup data is encrypted both in transit and at rest. Review encryption key management and confirm that backup storage locations meet the organization’s security requirements. Backups often hold sensitive data and must be treated with the same care as live databases. 📌 Access and Retention Controls Audit who has access to backup repositories and management consoles. Privileged access should be restricted and monitored. Retention policies must comply with regulatory or business requirements to prevent data from being deleted too early or retained too long. 📌 Testing the Backups Backups are only as good as their ability to restore. Verify that periodic restore tests are conducted, documented, and reviewed by management. Restoration testing confirms not only data integrity but also the readiness of people and processes in real incidents. 📌 Backup Failure Monitoring Review how backup failures are tracked and resolved. Alerts should be configured to notify responsible teams immediately. Unattended failures mean unprotected data. Database backup integrity isn’t just about compliance; it’s about survival. In the face of ransomware, system failure, or human error, verified and secure backups determine whether a business can recover or collapse. IT Auditors must make sure that the safety net truly holds. #DatabaseSecurity #DataProtection #BackupIntegrity #ITAudit #CyberSecurityAudit #RiskManagement #BusinessContinuity #DisasterRecovery #InformationSecurity #GRC #CyberVerge #CyberYard

THE CRC32 FUNCTION IN DREMIO The CRC32 function in Dremio SQL is used to compute a binary string's cyclic redundancy check or CRC value. A CRC is a type of hash function that produces a checksum, detecting data storage or transmission errors. By comparing the CRC value of data at its source and its destination, you can tell whether the data has changed during transfer. This can be extremely useful in situations where ensuring data integrity is essential. For instance, you might use it when sending data over a network, writing data to disk, or storing data in a database. SCENARIO IN THE IMAGE Imagine you're a data analyst at a large corporation. You've recently begun migrating a massive amount of data from an old, outdated database system to a modern, cloud-based data lake for more efficient data management and analytics. Before the data was ingested into the data lake, your team wisely decided to create a CRC32 checksum for each row of data to ensure that you could verify the integrity of the data after the transfer. So now you have a table, let's call it OldDatabaseTable, with columns Data and OriginalCRC, where Data is the actual data from each row in the old database and OriginalCRC is the CRC32 checksum calculated before the transfer. Your team has now ingested this data into the data lake, and your job is to ensure nothing was corrupted during the migration. So, you decide to use Dremio and the CRC32 function to verify the data integrity using the query in the image below. QUERY EXPLANATION CRC32(Data) calculates the CRC32 checksum of the Data in the new data lake. OriginalCRC is the original CRC32 checksum calculated before the transfer. The CASE statement compares these two values. If they're the same, it returns 'Match', indicating that the data is intact. If they're not, it returns 'Mismatch', signaling that something has gone wrong during the transfer. Running this query gives you a list of all your data and a new IntegrityCheck column showing whether the original and new CRC32 values match for each row. Using the CRC32 function, you can quickly and efficiently confirm that all your data was transferred to the new data lake without corruption, ensuring your team can confidently proceed with analysis and decision-making. If you find any mismatches, you know precisely which data you need to recheck and possibly retransfer, making the debugging process much more manageable.

Using Veeam Backup & Replication? Great. But it’s not just about having backups, it’s about building a resilient backup strategy that can stand up to ransomware, disasters, and human error. Here’s a proven framework to guide your backup approach: the 3-2-1-1-0 rule: • 3 copies of your data • On 2 different media types • With 1 copy stored offsite • 1 copy kept offline or immutable (e.g., hardened Linux repo) • And 0 errors in backup verification or recovery testing Combine that with security best practices for Veeam: • Use immutability to lock backups from changes, even by admins • Apply RBAC to restrict access to backup infrastructure • Encrypt backup data in transit and at rest • Enable MFA on all backup, related accounts • Use Veeam ONE or a SIEM to detect anomalies and changes Because if your backups are vulnerable, you don’t have a recovery plan, you have a false sense of security. Secure. Test. Verify. Then sleep better at night. #Veeam #BackupStrategy #RansomwareProtection #CyberResilience #DataRecovery #InfrastructureSecurity

Following the permanent loss of 858TB data due to a fire in a South Korea government datacenter, here's a reminder on the several technologies that are NOT backup solutions: RAID, snapshots, Apple Time Machine, Windows Volume Shadow, cloud storage, availability zone mirroring, database replication, Git/GitHub, DRBD. Real backups must to be automatically maintained as multiple encrypted, integrity-checked, tested, monitored, and documented historical copies, on different media, offsite, and offline or immutable. https://lnkd.in/d8Y-Hb4y

You likely know having a backup is essential—but it’s not enough. A backup that hasn't been validated could leave your business vulnerable when disaster strikes. Whether it's a ransomware attack, hardware failure, or accidental deletion, relying on untested backups can lead to incomplete or corrupted data recovery. Periodically restore data from backups to verify their integrity. Don’t assume they work—test them! Implement the 3-2-1 rule: 3 copies of your data, on 2 different media types, with 1 stored off-site. Use automated tools to monitor your backup processes and receive alerts for any failed jobs or inconsistencies. Ensure backups are encrypted, both in transit and at rest, to protect against unauthorized access. A validated backup system ensures you're not just backing up data, but backing up reliably. Thus, giving you peace of mind when you need it the most. If the backup does not have validated recovery, it is not a backup – it is, at best, a hope! - Keith Palmgren Don’t wait for a crisis to find out your backup plan wasn’t enough!

Nearly 30% of SQL Server downtime comes from storage issues. Most happen silently. You won't know until it's too late. That's where PAGE_VERIFY = CHECKSUM comes in. It catches corruption before it spreads to your backups. Before it causes real damage. Most SQL Server instances since 2005 have this enabled by default. But nobody tells you it only protects NEW pages. Existing data? Still vulnerable. Three steps to fix this: 1. Check your current settings across all databases 2. Enable CHECKSUM where it's missing 3. Force page rewrites to protect existing data I've gone into much more detail in the blog post below, covering: - How to identify which databases need fixing - Scripts to enable CHECKSUM across all databases - How to verify it's actually working on your data pages Check it out: https://lnkd.in/eHEX4Q9V

𝗢𝗧 𝗕𝗮𝗰𝗸𝘂𝗽𝘀 𝗔𝗿𝗲 𝗡𝗼𝘁 𝗮𝗻 𝗜𝗧 𝗕𝗮𝗰𝗸𝘂𝗽 𝗣𝗿𝗼𝗯𝗹𝗲𝗺. 𝗧𝗵𝗲𝘆 𝗮𝗿𝗲 𝗮𝗻 𝗢𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗥𝗲𝗰𝗼𝘃𝗲𝗿𝘆 𝗣𝗿𝗼𝗯𝗹𝗲𝗺. NIST’s new 𝗢𝗧 𝗕𝗮𝗰𝗸𝘂𝗽 𝗤𝘂𝗶𝗰𝗸 𝗦𝘁𝗮𝗿𝘁 𝗚𝘂𝗶𝗱𝗲 — 𝗦𝗣 𝟭𝟯𝟯𝟵 makes one thing very clear: In OT, backup is not just about copying files. It is about restoring the process safely, correctly, and fast enough to keep critical operations running. A good OT backup strategy should answer five practical questions: 𝟭. 𝗪𝗵𝗮𝘁 𝗺𝘂𝘀𝘁 𝗯𝗲 𝗯𝗮𝗰𝗸𝗲𝗱 𝘂𝗽? Not only servers and workstations. Also PLC logic, DCS configurations, HMI graphics, I/O lists, firmware, license keys, vendor tools, historian configurations, network diagrams, and supporting software. 𝟮. 𝗪𝗵𝗶𝗰𝗵 𝗮𝘀𝘀𝗲𝘁𝘀 𝗺𝗮𝘁𝘁𝗲𝗿 𝗺𝗼𝘀𝘁? Backup frequency and recovery sequence should be based on mission criticality. Not convenience. 𝟯. 𝗖𝗮𝗻 𝘄𝗲 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗿𝗲𝘀𝘁𝗼𝗿𝗲? A backup that has never been restored is only an assumption. Test restoration on non-production systems and validate the functional integrity of the restored system. 𝟰. 𝗖𝗮𝗻 𝘄𝗲 𝘁𝗿𝘂𝘀𝘁 𝘁𝗵𝗲 𝗯𝗮𝗰𝗸𝘂𝗽? Use hashing, encryption, write-once media, access controls, and OT-approved validation methods such as offline-to-online logic comparison. 𝟱. 𝗗𝗼 𝘄𝗲 𝗵𝗮𝘃𝗲 𝘁𝗵𝗲 𝗿𝗲𝗰𝗼𝘃𝗲𝗿𝘆 𝗲𝗰𝗼𝘀𝘆𝘀𝘁𝗲𝗺? In OT, recovery may need engineering laptops, vendor software, special cables, licenses, spare parts, printed drawings, SRS, cause-and-effect matrices, and people who know the plant. The uncomfortable truth: Many OT environments have backups. Very few have a proven, tested, and operationally aligned recovery capability. In OT security, backup is not the end of incident response. 𝗜𝘁 𝗶𝘀 𝘁𝗵𝗲 𝗯𝗲𝗴𝗶𝗻𝗻𝗶𝗻𝗴 𝗼𝗳 𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗿𝗲𝘀𝗶𝗹𝗶𝗲𝗻𝗰𝗲. Reference: NIST SP 1339 — OT Backup Quick Start Guide, June 2026 #OTSecurity #Cybersecurity #ICSsecurity #OperationalTechnology #IncidentResponse #CyberResilience #NIST #IEC62443 #CriticalInfrastructure #BackupAndRecovery

The recent news on AWS center in the Middle East going down because of the war made me relive my experience decades ago! I once helped build what we proudly called a best-in-class disaster recovery architecture. We did everything right—on paper. ✔️ Business Impact Analysis done ✔️ RTO & RPO agreed with stakeholders ✔️ Sophisticated tools deployed ✔️ DR site fully provisioned We were confident. Almost too confident and then came the day that tested everything ! A dual power supply failure hit our primary data center. Within minutes, 300+ servers went down abruptly. What followed was worse than downtime: Critical application databases got corrupted AND THEN The DR site also got corrupted ! Real-time transactions came to a complete standstill. With every passing hour, we lost millions of dollars in revenue. In that moment, all our architecture diagrams, tools, and planning meant one thing: NOTHING —because the system didn’t recover !!! What this experience taught me: 1) Testing isn’t real until it’s brutal Table-top simulations give comfort. Full-scale failover drills expose truth. Test like it’s already failing: -Simulate real load -Introduce chaos scenarios -Assume components will fail unexpectedly 2) DR is not a technology problem—it’s a systems problem We focused heavily on tools. We underestimated dependencies. Ensure: -End-to-end recovery (infra + app + data integrity) -Isolation between primary and DR (to avoid cascade failures) -Backup validation, not just backup completion 3) Communication is your real recovery engine In crisis, confusion spreads faster than outages. Build: -Clear SOPs for business continuity -Pre-defined escalation paths -Regular cross-team drills (not just IT—include business teams) 4) Leadership presence changes outcomes War rooms are intense. Fatigue, panic, and noise creep in. As a tech leader: -Your presence brings calm -Your clarity drives prioritization -Your energy keeps teams going Sometimes, leadership is less about answers… and more about Stability 5) Assume your DR will fail—and design for that This was the hardest lesson. Build layers: - Immutable backups - Offline recovery options -“Last resort” recovery playbooks Because resilience is not about one backup plan. It’s about what happens when that backup plan fails... Have you ever seen a #DR plan fail in real life? How often do you run full-scale disaster recovery drills? What’s the one thing most organizations still get wrong about resilience? Curious to hear real experiences—those are always more valuable than frameworks. #DR #disasterrecovery #drill #test #BCP #leadership #technology #resilience

𝐀 𝐛𝐚𝐜𝐤𝐮𝐩 𝐲𝐨𝐮’𝐯𝐞 𝐧𝐞𝐯𝐞𝐫 𝐭𝐞𝐬𝐭𝐞𝐝 𝐢𝐬 𝐚 𝐥𝐢𝐚𝐛𝐢𝐥𝐢𝐭𝐲 𝐝𝐢𝐬𝐠𝐮𝐢𝐬𝐞𝐝 𝐚𝐬 𝐩𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐨𝐧.⁣ ⁣ I want that to land clearly.⁣ ⁣ In Managed IT Services and cybersecurity for SMBs, backup strategy is business continuity.⁣ ⁣ But here’s what I often uncover:⁣ ⁣ “𝘉𝘢𝘤𝘬𝘶𝘱𝘴 𝘢𝘳𝘦 𝘳𝘶𝘯𝘯𝘪𝘯𝘨.”⁣ ⁣ That is not the same as restore validation.⁣ ⁣ When ransomware hits your Microsoft 365 environment or your server fails, there is no room for uncertainty.⁣ ⁣ And yet many small businesses operate without:⁣ ⁣ • Documented Recovery Time Objectives⁣ • Quarterly restore simulations⁣ • Immutable offsite backups⁣ • Backup monitoring alerts⁣ • MSP reporting on backup integrity⁣ ⁣ In that moment, leadership realizes too late that the protection was assumed, not verified.⁣ ⁣ Managed IT Services should eliminate that uncertainty.⁣ ⁣ If your business depends on its data, your backup strategy must be proven, not presumed.⁣ ⁣ 3 immediate actions:⁣ ⁣ 1. Test a full restore, not just a file recovery.⁣ 2. Confirm Microsoft 365 backup coverage beyond default retention.⁣ 3. Require documentation from your MSP showing monitoring and restore validation.⁣ ⁣ When your recovery plan is solid, crises become controlled events.⁣ ⁣ When it is unclear, crises become catastrophic.⁣ ⁣ Cybersecurity is not dramatic until it is.

Are Your Backups Ready for the Worst? 🚨 Matt Johnson and I are teaming up to tackle this head-on. Together, we’re helping businesses move beyond blind trust to real backup reliability. In business, "Our backups are good" isn't enough. Backups are your safety net, but unless you're actively testing, monitoring, and verifying them, you could be left unprotected when disaster strikes. 📊 Here’s a reality check: One client believed their backups were running smoothly until they weren’t. When a system failure hit, the backups failed to restore because they hadn’t been properly tested. The result? Hours of downtime and significant data recovery costs. 💡 How to make sure your backups work when you need them most: 1️⃣ Test regularly. A backup that hasn’t been tested might as well not exist. 2️⃣ Use advanced monitoring tools to ensure backups are running successfully. 3️⃣ Understand your tools. Don’t just set it and forget it know what alerts mean and how to act on them. 🔑 Pro Tip: Ask your team to show you the process don’t rely on verbal assurances. Clear documentation and regular reviews are critical to ensuring you’re truly protected. 👉 When was the last time you tested your backups? Let’s talk about creating a system you can trust. Share your thoughts below or reach out directly we’re here to help! 💬 👉 https://mind-core.com/ #CyberSecurity #DataProtection #BusinessContinuity #BackupSolutions