Any organization, whether an SMB or enterprise company, has production processes heavily dependent on data. Thus, regular backups are critical to ensure business continuity and data availability for compliance, analytics, sales and other purposes.
Cloud backups can be considered a reliable option because cloud providers ensure high availability of their storage for customers. Azure Blob storage is one of the clouds you can use as a backup destination. In this post, we explain:
- Why use Azure Blob to store backups
- How to ensure backup data security in Azure
- Cost of Azure Blob storage
- How to send backups to Azure efficiently
Azure Storage Backups: Why You Need Them
A backup is the only reliable solution to keep control over an organization’s data assets in case the original data is lost, damaged or encrypted after an incident. However, disasters that can hit production environments threaten onsite backups as well. For example, a natural disaster or a power outage in your office or data center will render both the original data and the onsite backup data inaccessible. In ransomware scenarios, the case remains relevant as well. Hackers planning ransomware attacks understand the role of backups and target backup repositories equally to the production environment.
Cloud backups, such as backup to Azure Blob storage, are offsite backups with one undisputed advantage: constant availability. You can access data backups in the cloud regardless of the current status of your infrastructure. Therefore, recovering data from cloud backups in Azure is possible even when your main site is down.
Below we explain the details you might want to consider when thinking about backup storage in Azure, such as access levels, backup security provisioning and prices.
Azure Storage Access Levels
Azure Blob a convenient backup storage solution because it offers a variet of strage tiers. At the moment, Azure offers three storage tiers:
- Hot: The standard tier which is also the most expensive. This tier suits well if you need to ensure the shortest RTO, as the access to your backup data is the quickest here.
- Cool: With this tier, you can reduce storage costs for data you don’t plan to access more frequently than once a month.
- Archive: 80% cheaper than the Hot storage tier, the Archive tier is also the slowest. Accessing the Archive tier data in Azure Blob can take hours, so the tier does not suit short RTO requirements.
Each tier can provide nearly equal data resilience and availability levels. Still, minor differences in tier specifications are present. For instance, the guaranteed availability of Hot storage is 99.99% while that of Cool storage is 99%. In addition, you can customize your configuration by, for example, copying backups across data centers in multiple regions to add data reliability.
Backup Azure Storage: Security Recommendations
Microsoft is serious about security requirements and uses a FIPS-140 cipher and AES-256 encryption on the server side. These default encryption algorithms are enabled all the time by default – you can’t switch them off under any circumstances. However, the encryption itself is not enough to ensure proper security of cloud backup data in Azure Blob.
For additional resilience of your backups, consider following the recommendations:
Get Account Access Keys Secured
On storage account creation, Azure generates two 512-bit storage account access keys for that account. You then use those keys in Shared Key authorization to access the account and manipulate the data. If any third party gets those account access keys, this may result in data breakage or loss.
Therefore, you need to ensure that Azure account access keys are stored securely.
Regenerate Keys Periodically
Don’t get too comfortable about your security measures. Generating new access keys, for example, once a month, is a useful practice that can help you remain confident about the protection of your Azure account. That way you ensure that even a leaked access key is useless once you get a new one.
Apply the Principle of Least Privilege
The Principle of Least Privilege (aka PoLP) is the basic security rule in IT that works for any infrastructure or organization. The point of the principle is to grant a user’s account as much access to the environment as their job duties require. Any action that a user doesn’t need and would not decrease their productivity should be restricted to that user.
Therefore, only admins working directly with data protection and recovery workflows should have access to backups in Azure Blob storage. Establishing a special account with unique and regularly updated credentials is another solid practice to boost the security of backup copies in Azure.
Disable Anonymous Public Access
In Azure, users can have the opportunity to access Blobs anonymously. By default, anonymous public access is disabled in Azure, but double-checking access settings is an efficient security practice in this case. Access can be granted accidentally or due to previous malicious activities you tend to treat as countered.
Authorize Access with Azure AD
Using Azure Active Directory capabilities to boost security of your cloud backups is another solid choice. With AD, you can configure two-factor authentication, control identity of users logging into the cloud repository and ensure role-based access to the required resources with the configurable timing.
Use Immutable Blobs and Versioning
Immutability protects data from alteration or deletion within the set period, thus working as an anti-ransomware tool. Immutable backups in Azure can then be used for recovery even if hackers manage to infiltrate cloud storage. Versioning enables you to have several recovery points for backup data, which you can rotate according to your organization’s data protection policies.
Enable Firewall Rules
Setting Azure Firewall rules can help you keep your data and infrastructure security policies. Additionally, Firewall rules give you an additional access control lever for your cloud destinations, making reaching those backup repositories more challenging for unauthorized actors.
Restrict Network Access
Enabling network access for trusted hosts and networks is a way to set additional filters for your traffic and control data access. Just like other security elements, this can be configured flexibly according to the requirements and hardware capabilities to provide an adequate level of protection.
Azure Blob Storage Costs Analyzed
Azure Blob offers a flexible pricing model for storage accounts. As a user, you can choose the most suitable solution regarding your organization’s requirements and backup policies. There are two storage payment models: pay-as-you-go and paying for a reserved capacity you get committed to for 1 to 3 years.
Additionally, Azure Blob has payments charged beyond those for the storage itself. You also need to count operational fees and keep in mind that a tier with a higher storage cost has lower cost of access.
Generally, the final Azure Blob storage costs depend on the following:
- Region: To provide general availability of services, Azure has multiple regions globally in Americas, Europe, Middle East, Africa and Asia Pacific with different costs of access.
- Storage pricing: Counted per gigabyte, the cost for storage depends on the total amount of data you store in Azure cloud.
- Operation pricing: Microsoft charges prices for operations performed inside the service, including writing, reading and deleting data in Azure Blob Storage.
- Access tiers: Once again, Azure has various price levels that depend on the tier of the storage you choose:
- The Hot storage tier has the highest availability and can be used for frequent access and fast recovery, but this tier is also the most expensive.
- The Cold tier is the optimal price/value solution that provides the best functionality to access the data not more than once in a month.
- The Archive tier is the cheapest, however you need to send a request for data access and then wait before that access is granted. The minimum retention period here is 180 days.
- The redundancy level: This parameter defines how many of your data copies are stored in different regions, and how fast the access can be in case of a data loss scenario.
Note: Cool storage has lower price per gigabyte; however, accessing the data there costs more. Try using the Azure pricing calculator to get an estimate before you create an account and send your backup data there.
Use Azure Blob Storage as Backup Destination Efficiently
A modern organization, even if it’s a small business company, generates and processes immense amounts of data every day. Sending those data amounts to Azure cloud destinations manually is still an option, but you might reasonably doubt the effectiveness of such manual workflows. Not to mention how challenging and slow the manual recovery process can be.
Contemporary data backup and recovery solutions, such as NAKIVO’s backup to Azure Blob storage can streamline your backup to Azure Storage. Schedule automated backup workflows according to your organization’s requirements and capabilities, and ensure that you always have relevant backups in the cloud. The solution can also provide features for fast full or granular recovery from cloud backup repositories, helping you reach the tightest RPOs and closest RTOs. Moreover, you can configure immutability, set two-factor authentication and role-based access control for backups in the solution, customize network settings and storage options to boost protection and enhance infrastructure reliability while reducing overall costs.
Conclusion
Cloud data backup in Azure Storage is an efficient choice to have an offsite backup that can be used for recovery when the main site and onsite backups are unavailable. You can optimize storage costs with the flexible Azure pricing model. Cloud backup security can be significantly improved by multiple options and features of Azure, too.
To make data backup and recovery with Azure more efficient, try using an all-in-one data protection solution, such as NAKIVO Backup & Replication. You can schedule and automate backups to ensure data relevance, set recovery workflows and use additional security features to ensure data control and production continuity for your organization.
