A Backup You Have Never Restored Is a Wish

Everyone backs up. Almost nobody restores. So the backup sits there, growing, quietly reassuring, and completely untested. It is not a safety net. It is a photograph of one. The day you need it is the worst possible day to discover that the job has been failing since March. That the archive is encrypted with a key that lived on the machine you are trying to recover. That it holds the database but not the uploads. That it takes nine hours, and the business gave you two. None of that is exotic. All of it is ordinary. An attacker who reaches your data will reach your backups next, because they sit on the same network, under the same account, behind the same key. That is not a backup. That is a second copy of the same hostage. So test the restore. Not the theory. The restore. Into a clean place. With a clock running. By someone who was not there when it was built. Write down how long it took, because that number is your real promise to everyone downstream. Everything else is marketing. Keep one copy somewhere your production credentials cannot reach. Keep one copy that cannot be deleted, even by you, even when you are certain. And do not trust the log line that says the job succeeded. A green tick is a claim. It is not evidence. Security is not only keeping people out. It is being able to come back after somebody gets in. Anybody can copy data. The skill is putting it back while the phone is ringing and nobody agrees on what happened. Practise the boring version too. Not only the fire. One deleted table on an ordinary Tuesday, because that is usually how it starts. Not an attacker. A person, a missing clause, and a bad afternoon. Restore it once before you need it. Then it is a backup. Until then it is a wish with a filename. – Serguey Asael Shinder