Skip to content
Knowledge Hub/Article
Article

What Is Backup as a Service (BaaS)? How Cloud Backup Works

We explain agent-based and agentless backup, encryption keys, immutable copies, SaaS data, how BaaS differs from DRaaS and what to ask a provider.

Oğuzhan Gerçek··10 min read
What Is Backup as a Service (BaaS)? How Cloud Backup Works

Short answer: BaaS (backup as a service) is a model in which a provider runs the backup, storage and restoration of your data on its own infrastructure. Your organization decides what is backed up, how often and for how long; the software, storage and monitoring sit with the provider. Data is typically encrypted in transit and at rest. Against ransomware, its value lies in a copy that cannot be deleted even if your own accounts are compromised. Before you sign, pin down where the data will live, who holds the encryption key and how long a restore takes.

What is BaaS?

BaaS stands for backup as a service. In software development, the same acronym refers to backend as a service, a model in which, as Cloudflare describes it, developers get server-side functions such as user authentication and database management ready-made; this article is about backup.

IBM defines BaaS as a cloud-based data protection service in which a third-party provider manages the backup, storage and recovery of an organization's data; the organization keeps control of backup policies and chooses how much of the management to hand off. The idea of a backup does not change: in NIST's glossary, a backup is a copy of files and programs made to facilitate recovery if necessary. What changes with BaaS is who runs the infrastructure. You will find a short definition in our glossary.

How does BaaS work?

According to IBM, the organization first defines the scope (files, databases, virtual machines), how often backups run and how far back versions go. Data is then captured in one of two ways:

  • Agent-based backup: Software is installed on the protected machine. Azure Backup's MARS agent, for example, backs up files, folders and system state from on-premises machines.
  • Agentless backup: The backup is taken at the virtualization layer. According to Veeam's documentation, Veeam Backup & Replication does not install agent software inside the VM's guest OS and relies on VMware vSphere's snapshot capabilities instead.

According to AWS, for supported resource types the first backup is a full copy of the data, and each subsequent incremental backup copies only the changes. The heaviest step is the first upload: Microsoft notes that limited bandwidth or large data volumes can make the initial online backup take several days. In that case, the initial full backup can travel on shipped devices without using the network.

Encryption in transit and at rest: who holds the key?

According to IBM, encryption starts before the data leaves the organization. In Azure, data in transit moves over HTTPS and TLS, and stored backups are encrypted by default with platform-managed keys using 256-bit AES; customers can use their own keys instead.

Holding the key yourself gives you more control, but the cost of losing it is yours as well: the MARS agent encrypts backups with a passphrase set during installation, and Microsoft says it cannot recover the data without that passphrase. The UK's National Cyber Security Centre (NCSC) points to the opposite risk in its principles for cloud backups: to make encrypted backups useless, an attacker does not need to delete the data, only to delete or modify the key. The key itself therefore needs protecting, with an offline copy where appropriate.

Retention policies and immutable backups

According to the NCSC, retention should be tied to a fixed time period rather than to a number of backups; otherwise an attacker can push the clean copies out by writing a series of corrupted backups in quick succession.

An immutable backup cannot be deleted before its retention period ends, and cloud providers enforce this at the vault level:

  • AWS Backup Vault Lock: Applies a WORM (write once, read many) configuration to backups. In governance mode, users with sufficient IAM permissions can remove the lock; in compliance mode, once a grace time of at least 72 hours expires, the vault and its lock cannot be changed or deleted by any user or by AWS.
  • Azure Backup immutable vault: Blocks operations that could lead to the loss of recovery points, such as reducing retention. Once the setting is locked, it cannot be reversed.

CISA's #StopRansomware Guide (September 2023) also spells out the trade-off: immutable storage does not meet the compliance criteria of certain regulations, and misconfiguration can impose significant cost. We cover the 3-2-1 rule in our backup article and object lock in our object storage article.

Air gaps and ransomware

CISA's guide calls for backups to be kept offline, because many ransomware variants attempt to find and then delete or encrypt accessible backups. NIST defines an air gap as an interface between two systems that are not physically connected and between which data is transferred only manually, under human control. AWS's logically air-gapped vault provides a logical rather than a physical separation: it is always locked in compliance mode, and its backups can be restored from another account it has been shared with.

What BaaS adds is a copy that sits outside the organization's own administrative domain. According to the NCSC, an attacker who has compromised one system should not be able to make destructive requests without compromising another, separate system. In Veeam Cloud Connect, which service providers use to offer cloud repositories to their customers, enabling Insider Protection means that backups deleted from the tenant's console stay on the provider's side for a number of days the provider sets. We describe the attack itself in our ransomware article and the order of recovery in our recovery playbook.

SaaS data and shared responsibility

According to Microsoft, whatever the deployment type, the data remains the customer's responsibility, and that includes protecting it. In the documentation for its Microsoft 365 backup service, Microsoft describes the need through two scenarios: a ransomware attack that encrypts large swaths of data, and accidental or malicious deletion or overwriting from inside the organization. CISA, for its part, suggests considering a multi-cloud solution for cloud-to-cloud backups in case all accounts under the same vendor are affected. We explain who is responsible for what in our SaaS article and cover this kind of backup in our data protection and recovery service.

Restore testing

According to the AWS Well-Architected guidance, restoring from backup should be tested regularly to confirm that it can be done within the RTO; the restored data should be free of corruption, and any loss should stay within the RPO. The guidance lists assuming that the restore time falls within the RTO among common anti-patterns. With BaaS, connection speed also affects how long a large restore takes. AWS Backup's restore testing feature automatically and periodically evaluates whether restores work and monitors how long they take. We explain how to design an exercise in our DR testing article and how to set targets in our RPO and RTO guide.

BaaS, DRaaS and running your own backup infrastructure

Microsoft presents the two services as separate parts of a business continuity strategy: Backup keeps data safe and recoverable, while Site Recovery replicates workloads to a secondary location, so you can fail over there during an outage and fail back once the primary location is running again. In short, BaaS brings data back, while DRaaS keeps the business running on other infrastructure (see our DRaaS article).

With your own backup infrastructure, the hardware, software and monitoring are yours to manage, and writing backups to the cloud does not by itself make it BaaS. Software such as Veeam can write backups to cloud object storage, but the organization still runs the software. According to IBM, BaaS removes the need for organizations to maintain their own backup hardware and software, and Azure Backup allocates the storage itself and uses a pay-as-you-use model (see our CAPEX and OPEX article).

What to ask before choosing a BaaS provider

CISA recommends that, when an MSP maintains your backups, you use contract language to formalize your security requirements. Before you sign, get answers to these questions:

  • Location: In which country are the backups, and any copies made to other regions, stored? Keeping backups that contain personal data abroad can raise cross-border transfer questions under the KVKK (Türkiye's personal data protection law); see our article on KVKK and cross-border transfers.
  • Key: Who holds the encryption key, and how is the key itself backed up?
  • Immutability: How long does it last, and who can remove the lock?
  • Access and alerts: Is backup administration separate from production accounts (see our IAM article)? According to the NCSC, mass deletion requests, backups stopping or changes to retention periods should raise alerts, whether the attempts succeed or not.
  • Restores: How often are restores tested, does the report include the measured time, and what does the SLA commit to?
  • Exit: When the contract ends, in what format are the backups handed over, and how are the provider's copies deleted?

We cover running backup as a service in our backup, replication and recovery service, and measuring coverage and restore tests in our backup and data protection visibility service.

Frequently asked questions

What does BaaS mean? It stands for backup as a service: backup run by a provider. In software development, the same acronym also refers to backend as a service.

Is cloud backup the same as BaaS? Not quite. With cloud backup, the copy lives in the cloud, but the organization may still run the backup software; with BaaS, the software, storage and operations also sit with the provider.

Do you need a separate backup service for Microsoft 365? Under Microsoft's shared responsibility model, protecting the data remains the customer's job. Plan a separate backup for the scenarios that the application's own retention settings do not cover.

Which companies offer backup as a service (BaaS)? Public cloud providers offer backup services for their own platforms, and service providers use backup software to rent out cloud repositories. Before comparing names, check where the data will live, who holds the key and how restore tests are reported.

Sources