"Small businesses with a more organized approach to IT can perform daily backups and rotate them off-site for one to four weeks," said Chip Nickolett, the owner of systems integrator Comprehensive Consulting Solutions in Brookfield, Wisc. "There are also sometimes end-of-month, -quarter, -year, or other period archives that are retained permanently, but I see that at no more than 50 percent of the companies I visit."

He warned, however, against a commonplace SMB approach: nickel and diming on tape cartridge costs by over-reliance on incremental backups. Some companies use increment's correctly — backing up new data or changed files daily and conducting a full backup at least once a week. Others, however, try to get by with one initial full backup and do only incrementals thereafter, either on a daily or weekly basis. Many online services, for example, take this exact approach. Nickolett sees several potential problems with this method.

"Incremental backups are often used to save tapes and/or time, but the possibility for data or tape errors, or lost tapes is very high," said Nickolett. "Full backups are what I recommend."

Some SMBs argue against this by saying they have too many systems, and this requires too much infrastructure. One solution to this issue is to stagger backup schedules so different systems are backed up at different times or on different nights.

And when it comes to DR, of course, it is vital to fully document such procedures, as well as the environment, interfaces, interactions and dependencies. That way, someone performing a recovery will understand if additional work must be performed to make the environment consistent.

"Some systems are completely ignored because they are not viewed as being material or important, such as DNS and Active Directory servers, as well as gateway systems," said Nickolett. "This often causes last minute problems during recovery that require time consuming troubleshooting and ad-hoc recovery to fix."

Attila Kozma, president of Earth to Stars of Glendale, Calif., which sells ThetaBackup.com, said adding more backup and DR sophistication cannot be done well without hiring more staff. Without someone in charge, employees tend to move files between folders, not follow filing practice and in general create havoc with the data. As a result, unnecessary data will be backed up, and mission-critical data may be missed. With someone hired for IT, filing policies can be more easily enforced and misfiling can be corrected so proper folders/drives are backed up.

"Anywhere beyond 50 computers in the company, and you have to consider a full-time IT person," said Kozma. "He should be able to come up with the most optimal solution for the company."

One obvious place to start is to assign a dedicated computer for backup purposes. Rudimentary off-site protection can be achieved by placing this machine in a different location, even if it's in the owner's or the IT guy's house. For those with tight budgets, a commodity XP-based desktop can be used, although Kozma recommends having one with a RAID5 controller and configuring RAID5 to have a hot spare hard disk drive (HDD). That way, if one drive in the array fails, the hot spare takes its place.

This arrangement can be further enhanced in two ways. First, centralize all SMB files on one file server or network-attached storage (NAS) box to facilitate easy backups. Rather than backing up 50 or more machines, or a dozen servers, data can be backed up easily from one system. Of course, that means making sure employees (and the owner) save everything on the central system rather than on their desktops or laptops.

"One of the biggest sources of lost data is information kept on individual computers in the company and not in a central repository," says Kozma.

The second element is the creation of a virtual private network (VPN) between the central file server and the off-site backup computer. Fortunately, this is much easier than it used to be, as most new Internet routers have the capability to create a VPN. Software-based VPNs are also available, such as www.hamachi.cc from LogMeIn of Woburn, Mass. By connecting both sites via the VPN, mapping the different drives and configuring the backup software, a more robust backup setup can be established.

Which backup software to use is a matter of choice. Chris Schin, director of product management at Symantec in Cupertino, Calif., said he believes larger SMBs can create their own backup infrastructure using available technologies, such as Symantec products like Backup Exec 11d for Windows Servers (available online for $695.26) or Backup Exec System Recovery 7.0 Server Edition ($854.85).

"Backup Exec System Recovery enables businesses to recover complete Windows systems in minutes, not hours or days, and introduces enhanced Microsoft Exchange, virtual and data recovery capabilities," said Schin. "For many in the SMB segment, however, online backup presents a cheaper and better option than designing, procuring, building and maintaining a backup solution, and it has the added benefits of remote storage, expertly managed data centers and stringent SLA guarantees."

Replication Nation
What about replication? For many SMBs, replicating the IT environment to an off-site location is out of the question. As well as being expensive, such a set up is typically beyond the capability of a lone IT guy. It can also be difficult to manage.

"You want to get the backups at least 200 miles away from your primary location, and for businesses in Gulf Coast states, a copy should be out of state," said Rob Cosgrove, CEO of Remote Backup Systems of Memphis, Tenn. "Most SMBs of less than 200 staff members don't have the technical resources or staff to develop, install and manage their own replication site."

He said this is the reason many SMBs are replacing traditional tapes and on-site disk storage with online backup solutions. This enables them to take advantage of the enterprise-quality infrastructure of their providers as well as their off-site and replication services.

But online backup might not cut it in the eyes of auditors, government regulations or industry best practices. Nickolett, therefore, suggested an inexpensive way to implement replication that has worked at a few of his clients' sites.

"Something that we've done with several customers is to replicate the database transaction log or journal files that contain the changes [made] to the database since the last backup," said Nickolett. "These are small files that can be quickly and easily copied to a remote system and used for recovery if necessary."

Such a strategy assumes operational data is more dynamic than the environment supporting it, so an infrastructure recovery from the previous day would suffice in most cases. This approach requires custom program or script development to automate, but it is generally cost-effective, performs well, and can often be developed and implemented using in-house resources.

Alternatively, there are products that replicate database changes similar to the method described above but use commercial software instead of custom applications. GoldenGate Software in San Francisco is one vendor that offers such products.

Outsource It
SMBs, by necessity, must outsource many services to survive. For those that want to take a step beyond online backup, co-location might be a possibility. Large co-location facilities (whether from national providers, such as AT&T and Cogent Communications, or regional providers, such as Qwest and Norlight Communications) can provide hosting services at various locations for a monthly fee that is typically around $2,000 per rack or less, said Nickolett.

"This might be an option for SMBs with mission-critical applications and data that need a safer or more robust alternate site," he said. "When doing this, it is also helpful to think about workspace recovery — something critical for a full business continuity plan. Companies like Norlight Communications (in the Milwaukee area) can provide these services for a reasonable annual fee."