<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

---
technique: implementing-security-data-backup-strategy
name: implementing-security-data-backup-strategy
description: "Techniques and methodologies for implementing security data backup strategy"
subdomain: security-data-engineering
title: "Implementing Security Data Backup Strategy"
description: "Techniques and methodologies for implementing security data backup strategy"
tags:
  - backup
  - disaster-recovery
  - data-integrity
  - retention
  - business-continuity
metadata:
  mitre-attack: ["T1490"]
---

# Implementing Security Data Backup Strategy

> Design and implement backup strategies for security data including logs, alerts, forensic artifacts, and configuration data with integrity verification.

## Overview

Security data backup ensures that critical logs, detection rules, forensic evidence, and security configurations survive infrastructure failures, ransomware attacks, and insider threats. This technique covers immutable backups, integrity verification, and recovery testing.

## Core Concepts

- **Immutable backups**: Write-once storage that prevents tampering or deletion
- **3-2-1 rule**: Three copies, two media types, one offsite location
- **Integrity verification**: Cryptographic hashes to detect backup corruption or tampering
- **Retention alignment**: Match backup retention to compliance and investigation timelines
- **Recovery time objectives (RTO)**: Define acceptable downtime for each data category

## Workflow

1. Inventory security data assets and classify by criticality
2. Define RTO and RPO for each data category
3. Design backup architecture following 3-2-1 principles
4. Implement immutable backup storage with WORM compliance
5. Build integrity verification pipeline with hash chains
6. Configure automated backup schedules and monitoring
7. Test recovery procedures for each data category
8. Document backup runbooks and escalation procedures
9. Conduct quarterly backup recovery drills
10. Report backup health metrics and compliance status

## Implementation

```python
import hashlib
import json
from dataclasses import dataclass, field
from datetime import datetime
from pathlib import Path
from typing import Optional


@dataclass
class BackupManifest:
    backup_id: str
    timestamp: datetime
    source: str
    size_bytes: int
    checksum: str
    retention_days: int
    immutable: bool = True


class SecurityBackupManager:
    """Manage security data backups with integrity verification."""

    def __init__(self, backup_root: Path) -> None:
        self.backup_root = backup_root
        self.manifests: list[BackupManifest] = []

    def create_backup(self, source: str, data: bytes, retention_days: int = 365) -> BackupManifest:
        checksum = hashlib.sha256(data).hexdigest()
        backup_id = f"bk-{datetime.utcnow().strftime('%Y%m%d%H%M%S')}-{checksum[:8]}"
        manifest = BackupManifest(
            backup_id=backup_id,
            timestamp=datetime.utcnow(),
            source=source,
            size_bytes=len(data),
            checksum=checksum,
            retention_days=retention_days,
        )
        self.manifests.append(manifest)
        return manifest

    def verify_integrity(self, backup_id: str, data: bytes) -> bool:
        manifest = next((m for m in self.manifests if m.backup_id == backup_id), None)
        if not manifest:
            return False
        return hashlib.sha256(data).hexdigest() == manifest.checksum

    def get_expired(self) -> list[BackupManifest]:
        now = datetime.utcnow()
        return [
            m for m in self.manifests
            if (now - m.timestamp).days > m.retention_days and not m.immutable
        ]

    def backup_report(self) -> dict:
        return {
            "total_backups": len(self.manifests),
            "total_size_bytes": sum(m.size_bytes for m in self.manifests),
            "immutable_count": sum(1 for m in self.manifests if m.immutable),
            "expired_count": len(self.get_expired()),
        }
```

## Best Practices

- Store backup integrity hashes separately from the backups themselves
- Use immutable storage (S3 Object Lock, Azure Immutable Blob) for forensic evidence
- Test recovery monthly—untested backups are not backups
- Encrypt backups at rest with keys stored in a separate security boundary
- Monitor backup job completion and alert on failures within 15 minutes
- Maintain offline backups for ransomware resilience—air-gapped or cold storage

## Detection

```yaml
title: Security Data Backup Strategy Detection
id: dd223b8c-9286-4d9f-a5fe-fbae0b469854
status: experimental
description: Detects suspicious activity related to implementing security data backup strategy techniques in security data engineering context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*implementing*security*"
  condition: selection
level: medium
tags:
  - attack.t1490
  - attack.collection
falsepositives:
  - Data pipeline ETL processes during scheduled batch windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Security Data Backup Strategy Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1490 |

## Related Techniques

- [Performing Security Data Migration](../performing-security-data-migration/SKILL.md)
- [Building Security Data API Layer](../building-security-data-api-layer/SKILL.md)
