Subcontrol 10.3

[adammontville]

Test data integrity on backup media on a regular basis by performing a data restoration process to ensure that the backup is properly working.

Measures

M1 = # of total backup under test
M2 = # of working backup

Metrics

Backup Integrity quality = M2 / M1

[wmunyan]

Inputs:

• The current set of backup media for the organization

Operations:

• Given a sampling of backup media, restore the backup to a temporary location

Assumptions:

• The assumption is made that the organization will know what a "properly working" restored backup entails.

Measures:

• M1 = The number of backups under test
• M2 = The number of restored backups deemed "properly working" following restoration

Metrics:

• Backup Integrity Quality = M2 / M1

[wmunyan]

Add:

Inputs:

• t_i: the timestamp at which a backup restoration i has been performed
• N: the number of backup restorations (timestamps) performed so far
• M: the maximum possible irregularity (can be fixed as 30 day)
• T: (optional) target/desirable review interval threshold
• D: the number of backup restorations in which at least one anomaly was detected
• L: The total number of backup restorations

Operations:

• N/A

Measures:

• G (the average of log review) [0,X] = SUM_i=1_toN ( t(i+1) - t_i ) / N

Metrics: Calculate the variance of log reviews:

• Regularity Measure of Log Review V (measures the irregularity or variance of log reviews) [0, X] = (SUM_i=1_toN ((t(i+1) - t_i)-G)^2 / N ) / M (means if the maximum regularity if the variance is 0, and the higher the value the more irregularity)

If a threshold T for review is used, then calculate the variance according to the target interval:

• Threshold-based Regularity Measure of Log review V [0,X] = (SUM_i=1_toN ((t(i+1) - t_i)-T)^2 / N ) / M

P (The Probability of detecting an anomaly in log review) [0,1] = D / L

Quality of Log review [0,1] = (1-V) * P (means quality of review is high iff the review is highly regular and the potential is detecting anomalies (at least one per review) is also high)

[wmunyan]

Inputs:

• I1: The current set of backup media for the organization
• t(i): the timestamp at which a backup restoration i has been performed
• N: the number of backup restorations (timestamps) performed so far
• M: the maximum possible irregularity (can be fixed as 30 day)
• T: (optional) target/desirable review interval threshold
• D: the number of backup restorations in which at least one anomaly was detected
• L: The total number of backup restorations

Operations:

• Given a sampling of backup media from I1, restore the backup to a temporary location

Assumptions:

• The assumption is made that the organization will know what a "properly working" restored backup entails.

Measures:

• M1 = The number of backups under test
• M2 = The number of restored backups deemed "properly working" following restoration
• M3 [0,X] = SUM from i=1..N ( t(i+1) - t(i) ) / N

Metrics:

• Backup Integrity Quality = M2 / M1
• Regularity Measure of Log Review (V: measures the irregularity or variance of log reviews) [0, X] = (SUM from i=1..N ((t(i+1) - t(i)) - M3)^2 / N ) / M (means if the maximum regularity if the variance is 0, and the higher the value the more irregularity)

If a threshold T for review is used, then calculate the variance according to the target interval:

• Threshold-based Regularity Measure of Log review V [0,X] = (SUM from i=1..N ((t(i+1) - t(i) - T)^2 / N ) / M
• P (The Probability of detecting an anomaly in log review) [0,1] = D / L
• Quality of Log review [0,1] = (1-V) * P (means quality of review is high if-and-only-if the review is highly regular and the potential is detecting anomalies (at least one per review) is also high)

[wmunyan]

in all the metrics, substitute "backup restoration" for "log review" and its OK.