0Pricing
Cyber Security Academy · Lesson

Backup and Recovery Security

Secure backups.

Backup and Recovery Security is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Secure Backups

Backups are a safety net against failure, ransomware, and mistakes. But an unprotected backup is a full copy of your data sitting outside your main defenses. Securing backups is as important as securing the live database.

The 3-2-1 Rule

A proven backup strategy: keep 3 copies of data, on 2 different media types, with 1 copy offsite.

This protects against hardware failure, site disasters, and single-point loss. Add an air-gapped or immutable copy for ransomware resilience.

Encrypt Backups

A stolen backup must be useless. Always encrypt backups, both in transit to storage and at rest in storage.

# encrypted pg_dump piped through gpg
pg_dump appdb | gpg --symmetric --cipher-algo AES256 \
  -o appdb-2026-05-30.sql.gpg

Protect the Backup Keys

If the decryption key sits next to the backup, encryption gives no protection. Store keys separately.

  • Keep keys in a KMS or HSM, not on the backup server.
  • Limit who can access keys.
  • Rotate keys and re-encrypt periodically.

Access Control on Backups

Lock down where backups live. Treat the backup store as sensitive as the database.

  • Restrict bucket/folder permissions to a dedicated backup identity.
  • Block public access on cloud buckets.
  • Log every read and download of a backup.
# AWS S3: block public access on the backup bucket
aws s3api put-public-access-block \
  --bucket appdb-backups \
  --public-access-block-configuration \
  BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

Immutability Against Ransomware

Ransomware often deletes or encrypts backups before triggering. Immutable (WORM, write-once-read-many) or object-locked storage prevents deletion for a set period.

# S3 Object Lock retention concept
aws s3api put-object-retention --bucket appdb-backups \
  --key dump.gpg \
  --retention 'Mode=COMPLIANCE,RetainUntilDate=2026-12-31T00:00:00Z'

Offsite and Air-Gapped Copies

Keep at least one copy isolated from the production network. An air-gapped or logically separated copy survives an attacker who compromises the main environment and tries to wipe everything.

Test Your Restores

A backup you have never restored is only a hope. Regularly perform test restores to a clean environment to verify integrity and that the process works under pressure.

  • Confirm data completeness.
  • Measure restore time.
  • Document the runbook.

RPO and RTO

Two metrics shape recovery planning:

  • RPO (Recovery Point Objective): how much data loss is acceptable, driving backup frequency.
  • RTO (Recovery Time Objective): how fast you must be back online, driving restore design.

Point-in-Time Recovery

Combine periodic full backups with continuous transaction-log shipping to enable point-in-time recovery (PITR). You can roll the database back to just before a corruption or malicious change.

# PostgreSQL PITR concept: archive WAL
archive_mode = on
archive_command = 'gzip < %p | gpg -e -r backup@corp > /wal/%f.gpg'

Backup Security Checklist

Bring it together:

  • Follow 3-2-1 with an immutable/offsite copy.
  • Encrypt backups and store keys separately.
  • Restrict and log access to the backup store.
  • Define RPO/RTO and enable PITR.
  • Test restores on a schedule.

Quick Check

Apply the backup security principles.

Recap

Secure backups complete a resilient data strategy:

  • Use 3-2-1 with immutable, offsite copies.
  • Encrypt backups and keep keys separate.
  • Restrict and audit access to backup storage.
  • Define RPO/RTO, enable PITR, and test restores regularly.

Frequently asked questions

Is the “Backup and Recovery Security” lesson free?

Yes — the full text of “Backup and Recovery Security” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Backup and Recovery Security”?

Secure backups. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Backup and Recovery Security” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. SQL Injection Defense
  2. Access Control and Encryption
  3. Auditing and Monitoring
  4. Backup and Recovery Security
← Back to Cyber Security Academy