Awareness: Backing up data correctly

At our university, large amounts of data/files are produced every day, such as lecture notes, digital files or research results. As a rule, this data is stored on the central storage systems of the IT departements (home drives, group drives, project drives, ...). Those who use these possibilities for their official data do not have to take care of a data backup themselves. The data on the central file servers is backed up daily to tape by the IT departements. In addition, several versions of the files are usually kept and even deleted files are kept in the backup for a few more months before deletion takes place there as well. Due to the procedures/systems used at Trier University of applied siences, this backup is not lost even in the event of a successful ransomware attack (means that all files on the productive systems have been encrypted), because these backups cannot be subsequently encrypted.

The situation is different if you back up your data yourself to external drives such as USB sticks, external hard drives or locally on your device. We generally recommend external data media for backing up private data, but not for business data. After a ransomware incident, it will not be permitted to connect untested external data carriers to the restored infrastructure for security reasons. The IT departements willnot be able to provide service for these external drives in the event of loss, damage or even encryption, nor will they be able to verify them. The usefulness of these data backups is therefore questionable.

And another important note on data protection:
Personal data should generally only be stored on the central storage systems of the IT departements. This is the only place where data protection-compliant backups can be guaranteed. The loss of external data carriers or portable devices on which personal data is stored constitutes a data protection incident that must be reported.