{"id":4169,"date":"2026-09-08T16:13:12","date_gmt":"2026-09-08T16:13:12","guid":{"rendered":"https:\/\/quantinfor.com\/?p=4169"},"modified":"2026-09-09T07:57:46","modified_gmt":"2026-09-09T07:57:46","slug":"os-pilares-de-uma-infraestrutura-estavel-2","status":"publish","type":"post","link":"https:\/\/quantinfor.com\/en\/os-pilares-de-uma-infraestrutura-estavel-2\/","title":{"rendered":"False Security of Having Backups"},"content":{"rendered":"
\n
\n
_ CYBERSECURITY<\/h6>

False Security of Having Backups<\/h1><\/div>

Having backups does not guarantee that your company is protected<\/p><\/div><\/div>\n<\/div>\n\n\n\n

\n
\"\"<\/div>

Jo\u00e3o Mota<\/strong><\/p><\/div>

CTO | CMO<\/p><\/div><\/div>\n<\/div>\n<\/div><\/div>\n\n\n\n

\n
\"\"<\/figure>\n<\/div><\/div>\n\n\n\n
\n
\n

Having backups does not guarantee that your company is protected<\/h2><\/div>\n\n\n\n

A backup system only has true value when it guarantees the rapid recovery of information and ensures business continuity.<\/p>\n\n\n\n

For many years, most companies asked a simple question about their IT infrastructure: \u201cDo we have backups?\u201d<\/strong> Today, this question in itself is no longer sufficient.<\/p>\n\n\n\n

In a context where ransomware attacks, hardware failures, human error and operational disruptions are part of organisations' reality, the existence of an enterprise backup system does not automatically guarantee that a company can quickly resume its operations.<\/p>\n\n\n\n

The real issue is quite different: If tomorrow you lost all your systems, how long would it take until you could get back to work?<\/strong><\/h3><\/div>\n\n\n\n

It is the answer to this question that determines an organisation's recovery capability. And it is precisely at this point that many companies discover they have confused the existence of backups with a true business continuity strategy.<\/p>\n\n\n\n

A backup can exist and the company can still lose days of work<\/strong><\/p>\n\n\n\n

Imagine your company performs a backup every night. At first glance, this is an excellent practice. However, if an incident occurs at 5 pm, all information produced since the last backup could be lost. This includes invoicing, orders, ERP changes, documents, emails and all the work carried out by employees throughout the day.<\/p>\n\n\n\n

In practice, performing daily backups means accepting the possibility of losing up to a whole day's worth of information. Therefore, the most important question is no longer \u201cHow often do we take backups?\u201d<\/strong> and becomes \u201cHow much work are we really willing to lose?\u201d<\/strong><\/p>\n\n\n\n

Making backups is simple. Recovery is the real challenge.<\/strong><\/p>\n\n\n\n

Another frequent mistake is to assume that, because a backup exists, recovery will be immediate. In reality, restoring systems can take several hours or even several days, depending on the infrastructure, the volume of information and the recovery strategy implemented.<\/p>\n\n\n\n

During this period, the company continues to bear costs while seeing its business compromised. Employees are no longer able to work, invoicing may be interrupted, the ERP becomes unavailable and clients or suppliers stop getting a response. In many cases, the financial impact caused by the downtime far exceeds the cost of the incident that caused it.<\/p>\n\n\n\n

More than asking \u201cCan we recover the data?\u201d, it is important to know \u201cHow long will we be down until we are back to normal operations?\u201d<\/p>\n\n\n\n

An untested backup is merely an assumption<\/strong><\/p>\n\n\n\n

Many organisations run backups daily for years, but few regularly verify whether they can successfully restore the information. This is one of the biggest vulnerabilities in data protection strategies.<\/p>\n\n\n\n

A file might be corrupted, a server might not recover properly, an application might stop working after restoration or the procedure itself might depend on a member of staff who is no longer with the company. These problems are rarely identified during the backup process; they are usually only discovered when the organisation is already in a crisis situation.<\/p>\n\n\n\n

A disaster recovery strategy can only be considered reliable when it is regularly tested and validated under conditions similar to a real incident.<\/p>\n\n\n\n

The backup can also be compromised<\/strong><\/p>\n\n\n\n

Cyber attacks have evolved significantly in recent years. Nowadays, many ransomware attacks first seek to locate and eliminate backup systems before encrypting the remaining servers.<\/p>\n\n\n\n

When backups remain permanently connected to the infrastructure, use the same credentials or lack adequate protection mechanisms, they can be compromised along with the rest of the systems. When this happens, the company realises too late that, despite having backups, it no longer has an effective way to recover the information.<\/p>\n\n\n\n

The objective is not to protect files. It is to protect the business.<\/strong><\/p>\n\n\n\n

There is a fundamental difference between protecting data and protecting business continuity. Whilst backups aim to preserve information, a business continuity strategy seeks to ensure that the company can continue to operate with the least possible impact.<\/p>\n\n\n\n

For this, it is important to answer questions such as:<\/p>\n\n\n\n