Your management software stores what keeps your business running: customers, orders, invoices, stock, staff. If one day that data disappears, is encrypted in an attack or ends up in the wrong hands, the problem is no longer an IT one: it is a business one. This article reviews the basic measures for protecting that data and, above all, how to check that your backups really work.
What can go wrong
It helps to know what you are protecting yourself against, because each risk calls for a different measure:
| Risk | Example | Main measure |
|---|---|---|
| Hardware failure | The disk in the office server fails | Backups on another device and in another location |
| Human error | Someone deletes a financial year or overwrites a price list | Backups with several earlier versions |
| Ransomware attack | Malicious software encrypts your files and demands a ransom | Offline or immutable backups |
| Theft or loss | A laptop or mobile with access to the software is lost | Passwords, encryption and access blocking |
| Unauthorised access | A former employee still logs in with their user account | User and permission management |
| Disaster at the office | Fire, flood | Off-site backup |
Backups you can actually restore
A backup that has never been tested is a hope, not a backup. These are the questions you should be able to answer:
- What is backed up? The software's database, but also attached documents, templates, configuration and everything needed to reinstall.
- How often? Think about how much work you can afford to lose. If the answer is "none from a single day", the backup needs to be at least daily.
- Where to? A widespread practice is to keep several copies on different media, with at least one outside the office. That way a breakdown, a theft or a fire does not take everything at once.
- How many versions? If you only keep last night's backup and the error happened a week ago, the backup has the error too.
- Is it protected? A disk permanently connected to the server can be encrypted in the same attack. At least one copy should be offline or protected against changes.
- Who checks it? Someone has to confirm that it has run and has not reported an error.
- Have you tried restoring it? From time to time, restore a backup on a test machine and check that the software starts and the data is there.
If the software is in the cloud, do not assume backups are included. Ask the provider which ones it makes, how long it keeps them, whether you can request a copy of your data and how quickly they can restore it.
Who gets in and what they can do
Many problems do not come from outside, but from poorly managed access:
- One user per person. No shared accounts such as "warehouse" or "office". If you do not know who made a change, you cannot fix its origin.
- Permissions according to role. Whoever places orders does not need to see payroll; whoever invoices does not need to delete customers.
- Strong passwords and, if the software allows it, two-step verification, especially for access from outside the office.
- Joiners and leavers kept up to date. When someone leaves the company, their access is closed that same day, including on mobile.
- Regular review. Go through the list of users from time to time. There are often surprises.
Updates and devices
Attacks often exploit known flaws that already have a fix. Keep the operating system of servers and computers, the management software itself, browsers and the mobiles that access it up to date. A device that no longer receives security updates should not have access to company data. The Instituto Nacional de Ciberseguridad (INCIBE, Spain's National Cybersecurity Institute) publishes free security guides and resources for businesses on its website that make a good starting point.
What data protection regulations say
If the software stores personal data of customers, suppliers or employees, as is normally the case, the General Data Protection Regulation (Regulation (EU) 2016/679) applies, supplemented in Spain by Ley Orgánica 3/2018 (Spain's Organic Law on data protection). Two articles relate directly to this subject:
- Article 32, security of processing. It requires technical and organisational measures appropriate to the risk, and expressly mentions the ability to restore availability of and access to data quickly after an incident, as well as regular testing of how effective the measures are. In other words, backups that work and are checked.
- Article 33, notification of personal data breaches. If a breach affects personal data and poses a risk to individuals, it must be notified to the supervisory authority (in Spain, the Agencia Española de Protección de Datos, the Spanish Data Protection Agency) without undue delay and, where feasible, within 72 hours of becoming aware of it.
The Agencia Española de Protección de Datos has guides and tools for small and medium-sized businesses on its website. If your case is complex, consult a specialist.
If something fails: a simple plan
You do not need a hundred-page document. A single sheet that answers the following is enough:
- Who to call first: the software provider, the IT provider, management.
- Where the backups are and who knows how to restore them.
- How work carries on in the meantime: even if it is on paper for a few hours.
- Who decides whether a personal data breach has to be notified.
- How customers or employees are informed if they are affected.
Keep that sheet somewhere other than your computer too, because if the computer is the problem you will not be able to open it.
How we do it at Infonet
At Infonet Consultores we design, develop and maintain management applications, and after installation we keep providing direct support with the same team that developed them. Our applications run in the cloud, and we also handle GDPR adaptation and implementation and IT maintenance with immediate response. If you are thinking about new software, take a look at how we work in custom software development or get to know the team at software company in Huelva.
