Should we back up the configuration of firewalls, switches and routers?

Yes, and it is often forgotten. Network devices hold configuration that took years to build: firewall rules, VPN settings, VLANs, routing and access lists. If a firewall fails, is wiped by an attacker or has to be replaced after a compromise, rebuilding that configuration from memory takes days and usually introduces mistakes. Export the configuration automatically after every change and at least weekly, store the copies outside the devices themselves, ideally in version control so that you can see what changed and when, and keep at least one copy offline. Protect the exports, because they contain sensitive details and sometimes credentials or keys. A configuration history also has a security benefit: an unexpected new rule, account or port forward is a classic sign that someone has tampered with an edge device. Include restoring a device configuration in your recovery tests, ideally onto a spare unit.

Read next

← All 25 questions on Backups and recoveryAll topics