Creating a backup is half the battle. The other half is the question of how long a backup is kept before it is overwritten, and that is exactly what the rotation strategy governs. One of the oldest and most widespread is FIFO, first in, first out. What sounds simple has, from a security point of view, a decisive blind spot that every business should know before relying on it.
What does FIFO mean for backups?
FIFO originally comes from warehouse logistics: what was stored first also leaves the warehouse first. For backups the principle transfers to the rotation of backup media or storage locations: the oldest backup is deleted or overwritten as soon as a new one is added. This scheme originally dates from the time of classic tape backup, when companies worked with a fixed set of magnetic tapes. Today the same principle works just as well with hard drives, NAS snapshots or cloud storage with fixed capacity.
Ring rotation in practice
Best known is the classic weekly rotation with five tapes or storage locations, one per working day. Monday writes tape A, Tuesday tape B, and so on until Friday. The following week the cycle begins again with tape A, which thus overwrites the previous week's Monday backup. This is why it is also called a ring rotation: the media are rewritten in a circle again and again, the number of retained generations stays constant.
The scheme can be scaled as desired, depending on the security need with seven tapes for a full week including the weekend, with a separate set for month ends or as a pure daily rotation for frequently changing databases.
Advantages: simple, cheap, predictable
The great charm of FIFO is its simplicity. You only need a fixed, manageable number of media, the storage requirement stays constant and does not grow uncontrollably over time. Anyone in the team can explain the principle in one sentence, which eases documentation and handovers. The costs are also easy to plan: never more media are needed than defined at the start.
The decisive disadvantage: the short look-back horizon
This very constancy is at the same time the biggest weakness. With a classic 5-day rotation the available look-back never reaches further than one week. A data loss that is only noticed after eight days can no longer be restored cleanly with pure FIFO, the affected backup was long since overwritten.
For IT security this is a real problem, not a theoretical one. Ransomware today rarely encrypts data immediately after intrusion. Attackers often first gain access unnoticed for weeks, survey the network, secure several accesses and only strike when the damage is maximal, including the backup system. If the actual dwell time of an attack exceeds the rotation period, in the end all existing backups are already compromised or encrypted states, the oldest clean backup was long since overwritten.
What this means for recovery
Even apart from ransomware a pure FIFO rotation plan has consequences for an emergency: if a faulty data record, an accidentally deleted customer file or a faulty software migration is noticed late, the length of the rotation alone decides whether a clean state still exists at all. The shorter the ring, the narrower the time window in which a problem must be noticed for the recovery to still succeed.
FIFO and the 3-2-1 rule: a supplement, not a replacement
FIFO is a rotation scheme, not a complete backup strategy. It answers the question of how long a single copy is kept, not the question of how many independent copies exist at all. This is exactly where the 3-2-1 rule comes in: three copies of the data, on two different media types, one of them off-site. FIFO can sensibly control the rotation within one of these copies, for example the local NAS backup, but does not replace the external, physically separate third copy. Particularly important against ransomware: at least one copy should be immutable or separated by an air gap, that is not part of the overwritable ring that an attacker in the network could reach.
When is FIFO the right choice?
FIFO is well suited for data that changes frequently and where a problem is usually noticed quickly, for example daily database snapshots of a system that is closely monitored anyway, or as a quick, local interim backup with short access time. For the only or the longest-retained copy of sensitive business data, on the other hand, a pure FIFO rotation is too risky; here it is worth looking at tiered methods with a much longer look-back, such as the Hanoi rotation scheme.
Practical recommendation
Those who use FIFO should define three things before an emergency happens: first, a rotation length that is noticeably above the realistic time until a problem is discovered, for many businesses more weeks than days. Second, at least one additional, immutable copy separate from the ring outside the running rotation. Third, a regular restore test: a backup that cannot be restored in an emergency does not help regardless of the rotation scheme.
Conclusion
FIFO is a proven, simple rotation principle, but not complete ransomware protection. Anyone who relies solely on a short ring of overwritable media risks that in an emergency exactly the copy that would still have been clean is missing. solutioIT plans backup concepts for businesses in the Westerwald that combine rotation scheme, retention time and immutable copies so that in an emergency a clean recovery point really exists, as part of our server and network support.