On the Cost-Effectiveness of Backups, Part 1

Hello everyone.
I am Murashima, in charge of off-site and cold backup operations at Kachika Co., Ltd.!
I feel like I say this all year round, but I am just so sleepy...
Blaming it on temperature changes is an excuse that can be used for any physical condition if you really want to, so I shouldn't use it too much, but I resent these temperature changes.
Well, let's start with something unrelated again today.

It's going to be about money again, continuing from yesterday, but

Today, I would like to talk about the cost-effectiveness of backups.
I will skip the importance of data protection through backups. I have already talked about that extensively.
Let's start with the topic of losses.

The enormous economic losses that data loss brings to business

System failures and data loss occur, andthe "downtime" when business systems stop brings enormous direct and indirect costs to companies. Direct costs include lost sales, labor costs for recovery work, and emergency response expenses. Indirect costs include loss of customer trust, damage to brand image, reduced employee productivity, and fines for regulatory violations.
The average recovery time for major incidents in Japanese companies is 6 hours and 12 minutes, which is more than double the global average, and the downtime cost per minute amounts to 740,000 yen. As a result, the annual cumulative cost per company is estimated to reach 5.2 billion yen. The cost of downtime varies greatly depending on the size and industry of the company. Even for small and medium-sized enterprises, it can reach $137 to $427 per minute, and for medium to large enterprises, it can reach $9,000. In particular, in data-dependent industries such as banking/finance, government, healthcare, manufacturing, media, retail, and transportation/utilities, there are reports that the downtime cost per hour exceeds $5 million (approximately 720 million yen).

Cyberattacks, especially ransomware and data breaches, are one of the most serious threats in modern business, and the damage is expanding and becoming more complex year by year.According to data from the National Police Agency, in 2023, 37% of companies that suffered ransomware damage required 10 million yen or more in investigation and recovery costs, and the percentage requiring 50 million yen or more is also on an upward trend year by year (8% in 2021 → 16% in 2023). Small and medium-sized enterprises account for about half of the damage, and it takes many organizations more than a week to recover, with cases occurring where costs exceed 100 million yen. Manufacturing accounts for 68% of ransomware attacks, making it a particularly vulnerable industry.

According to IBM Japan's "2024 Cost of a Data Breach Report", the global average cost of a data breach reached $4.88 million (approximately 750 million yen), and the average damage amount in Japan recorded a record high of 630 million yen. The healthcare industry has had the highest average breach cost for 14 consecutive years at $9.77 million (approximately 1.5 billion yen), and the manufacturing industry has also seen a significant increase compared to the previous year. Furthermore, 63% of surveyed companies responded that they would raise the cost of products or services due to data breaches, suggesting the possibility that the burden will ultimately be passed on to consumers. Data breaches cause a wide range of financial and non-financial damages, such as claims for damages due to leakage of customer information, fines from regulatory authorities, loss of corporate image, and a decline in stock prices. These losses can far exceed direct recovery costs.

Data loss or corruption occurs due to various causes, such as human error (deletion or update mistakes), physical failure or aging of equipment, security threats like ransomware and Emotet, and even natural disasters such as power outages, fires, earthquakes, and floods. These risks are always present, and without an appropriate backup system, a single instance of data loss could lead to business suspension or, in the worst case, bankruptcy.

Data loss includes not only direct financial costs such as recovery expenses and lost sales, but also broader and harder-to-measure indirect losses such as loss of customer trust, damage to brand image, regulatory compliance costs, and potential damages. In particular, the fact that 63% of data breach costs are passed on to the prices of products or services suggests the possibility that companies will ultimately push that burden onto consumers, affecting the entire market. This increase in "invisible costs" and its ripple effect on the market suggest that backup investment should be positioned not just as an IT department issue, but as a management issue directly linked to corporate sustainability and social responsibility. Backups have extremely high value as a "preventive investment" to forestall these potential and enormous losses, and they serve as a foundation for companies to maintain competitiveness in the market and gain trust from society.

Downtime costs vary greatly depending on the industry and company size, and there are reports that ransomware damage also accounts for about half of small and medium-sized enterprises. It has been shown that the healthcare and manufacturing industries are particularly susceptible to data breaches and ransomware. This means that the more data-dependent an industry (e.g., healthcare, manufacturing, finance) or the larger the company, the more enormous the economic impact of data loss, and the more urgent and justifiable the investment in more advanced and robust backup solutions becomes. In these industries, data loss leads directly to business suspension or regulatory violations, and the resulting losses are immeasurable. On the other hand, it is pointed out that the damage is also enormous for small and medium-sized enterprises, and there is a high risk that a single instance of data loss will lead directly to bankruptcy. This fact suggests that just because a company is small does not mean that backups are unnecessary; rather, for small and medium-sized enterprises, while carefully considering cost-effectiveness, minimum backup investment commensurate with their size and budget becomes a "lifeline for business continuity". This emphasizes that in selecting backup solutions, it is necessary not only to compare costs but also to deeply understand one's own risk tolerance and business characteristics, and to clearly set priorities.

Thorough explanation of the cost structure of data backups

Costs of on-premises backups

On-premises backups tend to have high initial costs because the company procures, installs, and builds physical hardware such as servers and storage equipment itself. The standard server cost is around 500,000 to 3 million yen, but high-performance servers can cost 5 million to 10 million yen or more. In addition to the server itself, purchase costs for peripheral equipment such as routers (15,000 to 50,000 yen), UPS (30,000 to 80,000 yen), and PCs/mobile terminals (50,000 to 150,000 yen) also occur. System design and development, equipment installation, network construction, environment configuration, and the associated labor and construction costs are also required as initial investments, and in total, it is not uncommon for this to reach several million to over 10 million yen. Backup software license fees are also generally around 1 million to 10 million yen for a one-time purchase.

Operation and maintenance costs also occur continuously. In an on-premises environment, the company performs physical hardware maintenance, software operation, and troubleshooting itself, so continuous operational load and associated costs occur. Looking at the breakdown of data center operating costs, equipment costs account for the largest share at about 55%, while electricity, facility costs, and labor costs each account for about 15%. This suggests that a similar cost structure exists in on-premises environments. It is common for 10-15% of server construction costs to be incurred as annual operation and maintenance costs. It is also necessary to take into account periodic renewal costs due to equipment aging and labor costs for the continuous training and securing of technicians.

Costs of cloud-based backups

Cloud-based backup services have the major advantage that there is no need to purchase servers, and initial costs can be significantly suppressed to allow for a small start. Fees are mainly based on a pay-as-you-go system.

Major cloud services offer a variety of pricing structures. For example, Azure Backup began charging on August 1, 2019, and an example is provided where if an instance has 1.2TB of data, it costs $30 per month, plus $10 for every 500GB of incremental data, and $10 for the remaining 200GB. Azure Backup is evaluated as a simple platform with high cost-effectiveness. AWS Backup incurs charges based on a wide range of factors, including backup storage usage, data transfer between AWS regions, the amount of backup data restored, restore testing, backup searches, and Audit Manager. As an example, a scenario with a total monthly cost of $68.97 is shown. Cold storage is considered cost-efficient for long-term retention.

Other cloud backup/storage services show a wide price range of approximately 8,600 to 108,000 yen per month in ITreview's cloud backup product comparison, with specific examples such as 40,000 yen per year for 100GB of storage capacity and 120,000 yen per year for 1TB of cold storage. The unit price per 1GB for online storage varies significantly depending on the service, capacity, and contract type, such as Google Drive (0.5 yen/GB for the 2TB plan), OneDrive (0.4 yen/GB for the 6TB plan), Dropbox (0.2 yen/GB for the 15TB plan), and MEGA (0.3 yen/GB for the 16TB plan).

The cost of cloud backup services mainly fluctuates based on the following factors.The most basic billing factor is storage capacity, and it is often billed in GB-month units used. Generally, the unit price per 1GB tends to decrease as you contract for larger capacities. Data transfer costs are incurred when transferring backup data to the cloud or between different regions. Cross-region transfer, in particular, is a cost factor that requires attention.Costs are also incurred when restoring backup data. Restoring from cold storage takes time to retrieve data and may incur separate fees, so it is important to select an appropriate storage tier according to your Recovery Time Objective (RTO) and Recovery Point Objective (RPO) requirements.Costs also fluctuate depending on optional features such as additional support services, advanced security features (encryption, audit logs), management functions, restore testing, and the use of dedicated lines.

There is a price difference between individual and corporate plans. Individual plans are often provided for free or at a relatively low cost, with limited capacity (e.g., Google Drive 15GB free, OneDrive 5GB free). They are mainly intended for file sharing and synchronization.Corporate plans tend to have a higher unit price per 1GB compared to individual plans because they include advanced security features, detailed access permission settings, collaboration tools, and comprehensive support. Looking at company size, for small and medium-sized enterprises, a monthly cost of several thousand to several tens of thousands of yen is common; for example, if the backup data volume is around 1TB, many services cost around 10,000 yen per month.For large enterprises, the monthly cost can be several hundred thousand yen or more, but since they can back up large volumes of data, it is not necessarily expensive when considering the unit price per 1GB. It is important for small and medium-sized enterprises to choose between user-based billing or data capacity-based billing according to their growth prospects. About 40% of companies with 100 or more employees use cloud backup, and the larger the number of employees, the higher the adoption rate tends to be.

The cloud does not require server purchases or system development, so initial costs can be significantly reduced. On the other hand, on-premises requires an initial investment of millions to tens of millions of yen. Regarding operational load, the cloud reduces operational burden because the vendor handles maintenance and emergency response, which in turn leads to a reduction in labor costs. On-premises requires in-house operation and maintenance, which tends to result in a higher Total Cost of Ownership (TCO). In terms of implementation time, the cloud uses already completed services, so it can be used immediately after environment migration. On-premises requires designing and developing the system from scratch, which takes several months before it can be used. Regarding scalability, the cloud allows for flexible and rapid addition or reduction of resources, enabling quick responses to business changes. On-premises requires time and cost to add resources, and planned expansion must be considered in advance. In terms of security, on-premises is considered to reduce the risk of information leakage because it is intended for use within the company's own network, but risks exist depending on internal threats and management systems. Since the cloud is based on internet connectivity, it can be a target for malware and cyberattacks, but major cloud providers implement advanced security measures, and checking SLAs, multi-factor authentication, and monitoring are important.

So, since this has become quite long

I think I will stop here for today, but it ended up being a comparison of cloud vs. on-premises after all.
My desire for information on what happens if you follow the "1" in the "3-2-1 backup rule" that I have talked about so much in this note, and preferably the "3-2-1-1-0 backup rule" or the "5-2-1 backup rule," to be publicly available is not easily fulfilled. For example, if you think about it in line with the "on-premises vs. cloud" comparison table above, I think most companies will reach the conclusion of "going with the cloud." Wanting to reduce costs and effort as much as possible is something that is unavoidable not only for companies whose purpose is profit-seeking, but also for NPOs and public interest corporations. However, even though I named it "on-premises vs. cloud" myself, I feel a bit strange saying this, but

I would like you to take into account that you do not necessarily have to choose one or the other from theseと思うんですね。As I mentioned in "Information accidents that would not have happened if backups were done properly Part 2"
, the cost of backups is by no means a waste, but a strategic investment in the future. Rather than having an attitude of "it's fine if I just keep it," I hope you will prepare for malware, human error, and natural disasters by not just vaguely acquiring and storing backups, but by performing restore tests and restore training to ensure that those backups are truly "alive"
. If you use the cloud, on-premises, and our company, you can achieve the "3-2-1 backup rule" just by doing that
. Then, I would like to continue this article at a later date. Note that in this article, amounts appear in both dollars and yen, because both were found as far as I researched. It is not that I did not think about unifying them into yen at today's rate, but I decided to leave them as they were rather than tampering with them. Please understand.

AI Quiz Answer

This is a quiz where I give a prompt to an AI that I somehow end up using every day to have it draw a picture, and you guess the subject. Last time, it was this picture.

The answer was "Miyamoto Musashi." I think the difficulty level dropped quite a bit just by having a short sword tucked at his side. I have experience in Kendo from when I was a child, so I still sometimes think "I want to do Kendo" and dream of joining a new dojo. There were various things, but overall they are fun memories. As many of you know, it is possible to enter a Kendo match with a long sword and a short sword under Kendo rules. However, in Japanese Kendo, where the concept of a "valid hit" is important, there is almost no possibility of getting a valid hit while holding a bamboo sword with one hand. But, there are quite a few people in overseas Kendo tournaments who do Kendo because they love Japan, and it seems that such people sometimes enter matches with a long sword and a short sword. Miyamoto Musashi is a person about whom there is even a theory that he is a fictional character, but if he was a person who could get a valid hit while holding a real long sword and short sword in each hand, I think he is a person of terrifying superhuman strength. Well, the AI still has a long way to go. Shall we have it draw another historical figure from Japan today?

Let's go with a hint.

1. He is a military commander

2. There are various theories about his origin

3. He is a person who embodies the saying "Heroes love beauty" (← Big hint!)

Well, the announcement will be next time. Thank you very much.

We look forward to your continued support. Well, that's it for today.

Table of Contents

Specific risks inherent to cloud storage

Unique vulnerabilities of cloud storage

Complementary relationship between cloud storage and remote backups

Where the responsibility lies for data loss in cloud storage

Reasons why disaster recovery procedures should be determined in advance

Regarding the data and OS we handle at our company

Pros and cons of cloud storage

Microsoft, you can't be serious

How to create a business continuity plan Part 1

Could they be alternatives to Windows? Linux Mint and Chrome OS Flex

How to create a business continuity plan Part 2

Notes on how to create a business continuity plan Part 2

How to create a business continuity plan Part 3

5 cases where PC data is lost

I tried using BitLocker in various ways

How to create a business continuity plan Part 4

10 risks when PC data is lost

On the state of backups in the cloud-native era

On backups as a countermeasure against ransomware

Introducing recommended backup media for small and medium-sized enterprises

Data backup methods for small and medium-sized enterprises: Cloud is recommended

Problems and solutions for small and medium-sized enterprises when performing backups

On Linux backup features

Feeling my way through Apple products

A light personal information security memoir for today

Information threats that can be addressed by backups

Information threats that cannot be addressed by backups

Backup methods: What are offline and online backups?

Data backup: What is the appropriate approach for small and medium-sized enterprises?

Recent incidents regarding data backup

About our services

Let's look at the basics of security measures as defined by the IPA! Part 1

Let's look at the basics of security measures as defined by the IPA! Part 2

Let's look at the basics of security measures as defined by the IPA! Part 3

Let's look at the basics of security measures as defined by the IPA! Part 4

Let's look at the basics of security measures as defined by the IPA! Part 5

Let's look at the basics of security measures as defined by the IPA! Part 6

The difference between online backup and offline backup

Let's look at the basics of security measures as defined by the IPA! Part 7

About AI and backups

Let's look at the basics of security measures as defined by the IPA! Part 8

Personal restore incident report (T△T)

Let's look at the basics of security measures as defined by the IPA! Part 9

Companies that perform backups vs. companies that do not

Let's look at the basics of security measures as defined by the IPA! Final

The 3-2-1 Backup Rule: Evolving

Let's look at the documents released by the police!

Let's look at the documents released by the police! Part 2

Let's look at the National Center of Incident Readiness and Strategy for Cybersecurity (NISC)!

Let's look at the National Center of Incident Readiness and Strategy for Cybersecurity (NISC)! Part 2

Let's look at the National Center of Incident Readiness and Strategy for Cybersecurity (NISC)! Part 3

Let's look at the National Center of Incident Readiness and Strategy for Cybersecurity (NISC)! Part 4

Various things regarding hardware and backups

Let's look at the guidance for organizations in the event of a ransomware incident! Part 1

Let's look at the guidance for organizations in the event of a ransomware incident! Part 2

Traps hidden in commercial USB cables

Let's look at the guidance for organizations in the event of a ransomware incident! Part 3

Does the world's No. 1 market share router have security issues?

Let's look at the guidance for organizations in the event of a ransomware incident! Part 4

Crises in network equipment one after another

Let's look at the guidance for organizations in the event of a ransomware incident! Part 5

On malware trends from 2024 to the present

Let's look at the guidance for organizations in the event of a ransomware incident! Part 6

Can cloud services be trusted?

Let's look at the guidance for organizations in the event of a ransomware incident! Part 7

A story about when a backup was useful

When your daily-use HDD breaks

Let's look at the guidance for organizations in the event of a ransomware incident! Part 8

On unconventional ways to use backups

Regarding the details of our services

On recent topics regarding ransomware and backups

Let's look at the guidance for organizations in the event of a ransomware incident! Part 9

Please allow me to chat a little today

On automatic backups

Let's look at the guidance for organizations in the event of a ransomware incident! Part 10

The past and future of backups

—Solve the Case— CASE 1: Opening a folder is slow

Let's look at the guidance for organizations in the event of a ransomware incident! Part 11

—Solve the Case— CASE 2: Website data has disappeared Part 1

—Solve the Case— CASE 2: Website data has disappeared Part 2

Today I would like to ramble on about recent topics related to backups

Let's look at the guidance for organizations in the event of a ransomware incident! Part 12

—Solve the Case— CASE 3: Office destroyed by fire Part 1

—Solve the Case— CASE 3: Office destroyed by fire Part 2

Let's look at the guidance for organizations in the event of a ransomware incident! Part 13 (Final Episode)

Considerations Regarding Hybrid Backups

Regarding Data Recovery Operations, Part 1

Regarding Data Recovery Operations, Part 2

Regarding Data Recovery Operations, Part 3

Data Recovery Operations: Music CD Edition

Data Recovery Operations: Game CD Edition & Next-Generation Audio Edition

Data Recovery Operations: Other Edition

A Bit Late, but About Who I Am, Part 1

A Bit Late, but About Who I Am, Part 2

A Bit Late, but About Who I Am, Part 3

A Bit Late, but About Who I Am, Part 4

A Bit Late, but About Who I Am, Part 5

On Server Types and Their Backup Methods

Something That Might Be the End for Someone Who Handles Information to Say

Backups and the SDGs

Today I Would Like to Talk About Recent Topics Regarding Backups, Part 2

On the History of Computers and Backups

I Would Like to Talk About Recent Topics Regarding Off-site Backups

A Few Recent Topics Regarding Off-site Backups, Part 1

A Few Recent Topics Regarding Off-site Backups, Part 2

Information security incidents that would not have occurred if backups were properly maintained, Part 1

Information security incidents that would not have occurred if backups were properly maintained, Part 2

On the accounting treatment of backup costs

On the cost-effectiveness of backups, Part 2

The impact of backup strategies on mitigating damage from information security incidents, Part 1

The impact of backup strategies on mitigating damage from information security incidents, Part 2

On off-site backup strategies, Part 1

On off-site backup strategies, Part 2

On the latest technological trends in off-site backups, Part 1

On the latest technological trends in off-site backups, Part 2

On the latest technological trends in off-site backups, Part 3

On the latest technological trends in off-site backups, Part 4

On the latest technological trends in off-site backups, Part 5

On the latest trends in air-gap backups, Part 1

On the latest trends in air-gap backups, Part 2

On the latest trends in air-gap backups, Part 3

On the latest trends in air-gap backups, Part 4

On the latest trends in air-gap backups, Part 5

On the latest trends in air-gap backups, Part 6

On the latest trends in air-gap backups, Part 7

Simple and Inexpensive Data Backup Strategies for Small and Medium-Sized Enterprises Part 1

Simple and Inexpensive Data Backup Strategies for Small and Medium-Sized Enterprises Part 2

Simple and Inexpensive Data Backup Strategies for Small and Medium-Sized Enterprises Part 3

Simple and Inexpensive Data Backup Strategies for Small and Medium-Sized Enterprises Part 4

Simple and Inexpensive Data Backup Strategies for Small and Medium-Sized Enterprises Part 5

Simple and Inexpensive Data Backup Strategies for Small and Medium-Sized Enterprises Part 6

Simple and Inexpensive Data Backup Strategies for Small and Medium-Sized Enterprises Part 7

Simple and Inexpensive Data Backup Strategies for Small and Medium-Sized Enterprises Part 8

Today is an Extra Edition: Feeling Like Satchmo

Simple and Inexpensive Data Backup Strategies for Small and Medium-Sized Enterprises Part 9

Simple and Inexpensive Data Backup Strategies for Small and Medium-Sized Enterprises Part 10

The Importance of Off-site Backups Using Physical Media for Large Enterprises Part 1

The Importance of Off-site Backups Using Physical Media for Large Enterprises Part 2

The Importance of Off-site Backups Using Physical Media for Large Enterprises Part 3

Practical Backup Strategies Under Time and Budget Constraints Part 1

Practical Backup Strategies Under Time and Budget Constraints Part 2

Practical Backup Strategies Under Time and Budget Constraints Part 3

Practical Backup Strategies Under Time and Budget Constraints Part 4

Practical Backup Strategies Under Time and Budget Constraints Part 5

Backup Software by OS and Its Features: Windows Edition Part 1

Backup software by OS and its features: Windows edition, Part 2