← VCE Software Development U4O2

Essential Eight: regular backups

An Essential Eight strategy: keep tested, protected copies of data and code, made often, so work can be restored after loss, tampering or ransomware.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 95

Understanding Essential Eight: regular backups in VCE Software Development U4O2

What it does: Running the backup on a regular, frequent schedule matches the backup frequency sub-theme. The more often it runs, the less data is lost. Read-only access and an offline copy stop malware or attackers from changing the backup. That keeps it usable for restoring after ransomware. A backup that has never been restored might be corrupt or incomplete. Testing proves that data and code can really be recovered. If a backup sits next to the original, ransomware or a hardware failure can destroy both. Backups should be stored separately and protected. Backups do not break the ransomware. They give the team clean copies to restore, so paying the attacker is not needed.

Common mistakes: Backups must be tested, and a failed restore test needs attention. The alert should run when the test fails (test_fails), not when it passes. Backup frequency must match how often data changes and how much loss is acceptable. A 1 week gap loses far more than the 1 hour limit. It should be 1 hour or less.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Essential Eight: regular backups to a class →

This module's key terms are also in a printable crossword (Modules 81–95) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A team backs up its project code once a year. Is this a good backup frequency under the Essential Eight?
No. Backups should be made often enough that little work is lostYes. One backup a year is enough if the file is large
Matches
backup_schedule = "every 5 years"
↓
The backup is far too infrequent, so years of work could be lost. It should run daily or at least regularly, based on how much loss is acceptable.
Applying
Meanings
Term
regular backups
Meaning
An Essential Eight strategy: keep tested, protected copies of data and code, made often, so work can be restored after loss, tampering or ransomware.
Practice
backupFrequency ← "daily"
Testing
Gaps
(codeRepo, offsiteStorage)
Check Answer
Spots
2RUN restore_test ON copy
3IF test_passes THEN alert

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'African Wild Dog' badge — Savannah Streak, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A team backs up its project code once a year. Is this a good backup frequency under the Essential Eight?
A. No. Backups should be made often enough that little work is lost ✓
B. Yes. One backup a year is enough if the file is large
Backup frequency should match how much data the organisation can afford to lose. Active projects need frequent backups, such as daily or more often.
2. Which statement about testing backups is correct?
A. Restores should be tested to confirm the backup actually works ✓
B. A backup only needs testing if it is used for ransomware
A backup that has never been restored might be corrupt or incomplete. Testing proves that data and code can really be recovered.
3. Which is the best place to keep a backup of your code repository?
A. On the same server as the live repository
B. A separate, protected location away from the live system ✓
If a backup sits next to the original, ransomware or a hardware failure can destroy both. Backups should be stored separately and protected.
4. Ransomware encrypts every file on a developer's computer. What does a good backup let the team do?
A. Restore clean copies of the files without paying the ransom ✓
B. Decrypt the ransomware by running the backup again
Backups do not break the ransomware. They give the team clean copies to restore, so paying the attacker is not needed.
5. Which backup is better protected against tampering by an attacker?
A. A backup that every developer can edit and delete
B. A backup that normal user accounts cannot change or delete ✓
Backups should have restricted access, following least privilege. If an attacker can alter or delete them, they cannot be trusted for recovery.

Match the Pairs

backup_schedule = "daily" → Copies data and code every day, so only a small amount of work is lost if something goes wrong
restore_test(latest_backup) → Restores a backup to check it works before it is needed in an emergency
Backups should be made often so the amount of lost work after an incident stays small → RUN backup EVERY night AT 2:00
Backups must be protected from tampering so ransomware cannot encrypt or delete them → backup.access = "read-only"; backup.copy = "offline"
backup_schedule = "every 5 years" → The backup is far too infrequent, so years of work could be lost. It should run daily or at least regularly, based on how much loss is acceptable.
save backup TO live_server; never_test = TRUE → The backup sits on the same server as the live data and is never tested. Ransomware could encrypt both copies, and the backup may not restore at all. Store it separately and test restores.

Key Term

regular backups
An Essential Eight strategy: keep tested, protected copies of data and code, made often, so work can be restored after loss, tampering or ransomware.

Fill in the Blanks

1. BACKUP(codeRepo, offsiteStorage)
Hint: Type the command name that copies data or code to a separate, safe location.
2. backupEveryHours = 24
Hint: Type the number of hours that makes the backup run once per day.
3. testResult = RESTORE(latestBackup)
Hint: Type the function name that brings data back from a backup copy, proving the backup works.
4. backupFile = ENCRYPT(backupFile, key)
Hint: Type the function name that protects a backup so a stolen copy cannot be read.
5. IF backupAgeHours > maxAgeHours THEN
Hint: Type the comparison operator that checks whether the last backup is older than the allowed limit.

Spot the Error

Question 1
A RUN backup_job
B RUN restore_test ON copy
C IF test_passes THEN alert
D END IF
Line C — Backups must be tested, and a failed restore test needs attention. The alert should run when the test fails (test_fails), not when it passes.
Question 2
A SET changes TO 'every hour'
B SET max_loss TO 1 hour
C SET backup_gap TO 1 week
Line C — Backup frequency must match how often data changes and how much loss is acceptable. A 1 week gap loses far more than the 1 hour limit. It should be 1 hour or less.
Question 3
A backup = copy(data)
B encrypted = encrypt(backup)
C store(encrypted, disk)
D set_access(disk, everyone)
Line D — Backups must be protected from tampering and theft. Access should be limited to administrators (admins_only), not open to everyone.
Question 4
A SET schedule TO once per year
B RUN backup_job ON schedule
C RUN restore_test ON schedule
Line A — Regular backups are made often. A yearly schedule would risk losing months of work. The schedule should be frequent, such as every night.
Question 5
A def backup(files, dest):
B for f in files
C shutil.copy(f, dest)
Line B — A Python for loop header must end with a colon. It should be: for f in files:

Student with a class code? Join your class →