Backups
Offsite backup strategy: keep a recovery copy outside the failure domain
An offsite backup strategy puts a recovery copy outside the failure domain that can destroy production. “Offsite” should be defined by realistic threats: separate storage system, account/credentials, physical location or provider boundary as needed, plus a restore path that still works when production access is gone.
Name the failure domain you are escaping
A second disk in the same server protects against some disk failures but not server theft, controller failure, ransomware with root access, account deletion, or site loss. A provider snapshot may escape a guest disk but still share account/control-plane risk.
Choose the independent boundary based on the incidents that matter.
Separate destructive credentials
If a compromised production server can authenticate to the backup system with permission to delete every historical copy, malware can erase both. Use append-only/immutable features where available or credentials with narrower rights.
Protect the backup account with independent MFA/recovery and monitor deletions.
Plan transfer and retention economics
Estimate backup bytes, daily change, schedule, retention, bandwidth window, and restore egress/time. Compress/encrypt appropriately and avoid saturating production during peak traffic.
Monitor both repository capacity and transfer duration as data grows.
Practice recovery without production
Assume the source account/server is unavailable during drills. Retrieve credentials, select a recovery point, restore onto a clean destination, and verify the service.
- Define the failure domain.
- Separate deletion credentials.
- Budget transfer/retention.
- Drill with production assumed lost.