Backup and Disaster Recovery Guide for Qatar Businesses: 3-2-1 Strategy

Why Backup & DR Matters

• Ransomware: Average ransom demand in Middle East = QAR 2.5M+
• Hardware failure: 5–10% disk failure rate annually
• Human error: 25% of data loss is accidental deletion
• Natural disaster: Qatar flooding, power outages rare but possible
• Compliance: GDPR, HIPAA, banking regulations require backup proof

Cost of Downtime: QAR 50,000–100,000 per hour for critical services

The 3-2-1 Backup Rule

3 = 3 copies of data
2 = On 2 different media types
1 = 1 copy off-site

Example: 1 TB Critical Database

Copy 1: Primary production database (on-premises) Copy 2: Daily backup on NAS (Network Attached Storage) — same location Copy 3: Nightly backup to cloud (AWS S3 or Azure Backup) — off-site

Benefits:

• Ransomware encrypts copy 1 & 2? Copy 3 (off-site) is safe
• NAS fails? Restore from cloud backup
• Production server fails? Restore from NAS (fast, local)

---

Backup Strategy by Business Size

Small Business (1–10 Users, <100 GB)

Solution:

• Copy 1: On-premises external HDD (daily, incremental)
• Copy 2: NAS (Network Attached Storage, 2x redundancy)
• Copy 3: Cloud backup (Backblaze, Carbonite, or Azure Backup)

Cost: QAR 15,000–25,000 Year 1 RPO: 24 hours (1-day data loss acceptable) RTO: 4–8 hours (restore from backup)

Medium Business (10–100 Users, 500 GB–5 TB)

Solution:

• Copy 1: Primary production servers (on-site)
• Copy 2: Veeam backup to local NAS (Synology, QNAP)
  • Daily incremental backup
  • Weekly full backup
  • Retention: 30 days
• Copy 3: Cloud backup to Azure or AWS (Veeam to cloud)
  • Weekly backup sync
  • Retention: 90 days
  • Immutable storage (ransomware-proof)

Cost: QAR 40,000–60,000 Year 1 RPO: 24 hours (or 4 hours if hourly backup) RTO: 2–4 hours (restore from NAS), 4–8 hours (restore from cloud)

Large Enterprise (100+ Users, 5 TB+)

Solution:

• Copy 1: Primary production database (real-time replication to secondary)
• Copy 2: Veeam backup (continuous data protection, CDP)
  • Every 15 minutes = RPO of 15 minutes
  • Multiple restore points per day
  • NAS + SAN storage
• Copy 3: Disaster recovery site (hot standby)
  • Real-time replication to secondary data center
  • Automatic failover capability
  • Tested monthly

Cost: QAR 150,000–300,000 Year 1 RPO: 15 minutes (nearly real-time) RTO: 15–30 minutes (automatic failover)

---

Backup & DR Checklist

1. ☑ Define RPO & RTO

RPO (Recovery Point Objective): How much data loss is acceptable?

| Business Type | Acceptable RPO | |---------------|----------------| | Retail/E-commerce | 1–4 hours | | Financial services | 1 hour | | Healthcare | 1 hour (patient data) | | Manufacturing | 8 hours | | Government | <1 hour |

RTO (Recovery Time Objective): How long can you be down?

| Business Type | Acceptable RTO | |---------------|----------------| | Retail/E-commerce | 4 hours | | Financial services | 2 hours | | Healthcare | <1 hour | | Manufacturing | 4–8 hours | | Government | <2 hours |

2. ☑ Inventory All Data Sources

Identify:

• [ ] File servers (Windows Server, NAS)
• [ ] Databases (SQL Server, MySQL, PostgreSQL)
• [ ] Email (Exchange on-premises or Office 365)
• [ ] Applications (ERP, CRM, accounting software)
• [ ] Virtual machines (Hyper-V, VMware, KVM)
• [ ] Cloud services (Salesforce, Dropbox, OneDrive)
• [ ] Network devices (firewall configs, switch configs)
• [ ] CCTV recordings (retention 30–90 days)

3. ☑ Choose Backup Tools

Recommended:

| Tool | Cost/Year | Best For | Throughput | |------|-----------|----------|------------| | Veeam | QAR 30k–50k | VMs, servers, databases | 500 GB/hour | | Commvault | QAR 50k–80k | Enterprise, multi-source | 1 TB/hour | | Acronis | QAR 15k–30k | SMEs, simple setup | 300 GB/hour | | Bacula | QAR 5k (open-source) | Cost-conscious | 200 GB/hour | | Azure Backup | QAR 200/GB/month | Cloud-native, Microsoft shops | Unlimited |

4. ☑ Backup Schedule

Daily Schedule:

• 11:00 PM: Start incremental backup (files changed today)
• 2:00 AM: Backup completes
• 3:00 AM: Off-site cloud sync begins
• 6:00 AM: Backup validation check

Weekly Schedule:

• Saturday 10:00 PM: Full backup (baseline)
• Sunday 8:00 AM: Full backup sync to cloud

Monthly Schedule:

• Last Sunday of month: Full infrastructure backup
• Following Tuesday: Off-site backup transport

5. ☑ Storage Configuration

Local NAS (Copy 2):

• Minimum 2x data size (1 TB production = 2 TB NAS)
• RAID-6 redundancy (can survive 2 disk failures)
• Uninterruptible Power Supply (UPS) protection
• Network connected (1 Gbps minimum)
• Backup window: 4–6 hours for nightly backup

Cloud Backup (Copy 3):

• Object storage (AWS S3, Azure Blob, Google Cloud Storage)
• Immutable storage option (ransomware-proof, no deletion for 30 days)
• Geographic redundancy (automatic replication across regions)
• Encryption in transit (TLS 1.2+) and at rest
• Cost: ~QAR 100–300/TB/month

6. ☑ Testing & Validation

Monthly Backup Test:

• [ ] Restore test file from NAS (should take <5 minutes)
• [ ] Restore test VM from backup (should take <2 hours)
• [ ] Verify data integrity (no corruption)
• [ ] Document test results
• [ ] Document any issues

Quarterly Disaster Recovery Drill:

• [ ] Simulate server failure
• [ ] Restore from backup to different hardware
• [ ] Verify all apps start correctly
• [ ] Measure actual RTO (time to restore)
• [ ] Measure actual RPO (data loss, if any)
• [ ] Document findings

Annual Full Backup Audit:

• [ ] All backup configurations reviewed
• [ ] Storage capacity planning (is 2x enough?)
• [ ] Backup tool versions updated
• [ ] Security scan of backups
• [ ] Cost analysis (can we optimize?)

7. ☑ Ransomware Protection

Backup Hardening:

• [ ] Immutable storage enabled (no deletion for 30 days)
• [ ] Separate credentials for backup access (different admin account)
• [ ] Air-gap backup (disconnected from network, monthly)
• [ ] Write-once storage (WORM - Write Once, Read Many)
• [ ] Backup encryption with separate key management

Example: Veeam to Azure with immutable blob storage

• Backup created weekly
• Retained 90 days (cannot be deleted, even by attacker)
• Encrypted with Azure Key Vault
• Result: Ransomware proof

8. ☑ Documentation

Create:

• [ ] Backup policy (what, when, how long, where)
• [ ] Recovery procedures (step-by-step restore guide)
• [ ] Contact list (backup admin, vendor support)
• [ ] Storage credentials (encrypted in safe)
• [ ] Network diagrams (backup paths)
• [ ] Test results history (monthly tests logged)
• [ ] Retention policy (how long to keep old backups)

9. ☑ Monitoring & Alerting

Setup Alerts:

• [ ] Backup completion status (email alert if failed)
• [ ] Storage capacity warning (alert if >80% full)
• [ ] Backup age (alert if last backup >24 hours old)
• [ ] Recovery test failures (alert immediately)
• [ ] Network connectivity (monitor WAN link to cloud)

Daily Checklist:

• [ ] Backup log review (any errors?)
• [ ] Storage utilization check (trending toward limit?)
• [ ] Network bandwidth usage (backups too slow?)

10. ☑ Compliance & Regulatory

Backup Retention Requirements:

| Regulation | Retention | Notes | |----------|-----------|-------| | GDPR | 7 years (financial), 1 year (logs) | Personal data must be erasable ("right to forget") | | HIPAA | 6 years | Healthcare records | | QCB (Qatar Banking) | 7 years | Financial records | | SOX (US Public Companies) | 7 years | Audit logs | | ZAKAT (Islam) | 2 years | Business records for zakat calculation |

---

Cost Breakdown (Medium Business, 2 TB)

| Component | Year 1 | Year 2+ | |-----------|--------|--------| | Veeam License | QAR 25,000 | QAR 25,000 | | NAS (Synology 2x8TB) | QAR 18,000 | QAR 0 (capex) | | UPS (2 kVA) | QAR 8,000 | QAR 0 (capex) | | Cloud Storage (2TB, 90 days) | QAR 6,000 | QAR 6,000 | | Cloud bandwidth (egress) | QAR 2,000 | QAR 2,000 | | Backup administration | QAR 12,000 | QAR 12,000 | | Quarterly DR testing | QAR 4,000 | QAR 4,000 | | Total | QAR 75,000 | QAR 49,000/year |

---

Red Flags in Backup Systems

✗ No off-site backup → Ransomware affects all copies ✗ Backup never tested → Will fail when you need it ✗ Single backup tool → Tool vendor goes out of business = stranded backups ✗ Backup credentials same as admin → Hacker gets both ✗ No immutable storage → Attacker can delete backups ✗ No monitoring → Backup silently fails, nobody notices

---

Star Tech's Backup & DR Services

✓ 3-2-1 backup architecture design ✓ Veeam implementation & configuration ✓ Cloud backup to Azure (immutable storage) ✓ Monthly backup testing & validation ✓ Quarterly disaster recovery drills ✓ Ransomware-hardened backups ✓ 24/7 recovery hotline

Design Your Backup Strategy → Free assessment of current backup gaps.