Communications of the ACM
Are You Confident in Your Backups?
The importance of data backups cannot be overestimated. Backups are essential for reducing the harm from hardware failures and lessening the effects of various hacker attacks, with ransomware being the most dangerous. At the same time, given the widespread availability of cost-effective enterprise backup solutions today, the encryption methods used by ransomware authors should not represent a significant threat. Implementing effective backup strategies is now easier and more affordable for organizations and individual users. However, significant challenges still persist in this area.
Why Backups Fail
Backups are often ineffective for several reasons, largely influenced by financial considerations. To cut IT costs, some companies do not back up all essential files or do so infrequently. Even organizations with extensive backup systems may fail to test them adequately, leading to difficulties in data restoration during crises.
Another common error is storing backups on network drives, which are prime targets for sophisticated ransomware attacks, along with local drives.
Human factors, like accidental or intentional deletion, also contribute to backup failures.
Additionally, natural disasters or accidents at the datacenter or site, especially if it is in a different country, can hinder access to backups, further complicating the situation.
How Many Backups Do You Need?
It is often wise to be a bit paranoid when it comes to data backups. Thanks to affordable cloud storage and tailored solutions, organizations can now securely store large amounts of their confidential data. The balance between cost and protection has shifted significantly compared to 10 years ago.
IT teams should schedule backups regularly to ensure they can recover the latest versions of critical files whenever needed. When setting up a backup system, two key measures are often considered: Recovery Point Objective (RPO) and Recovery Time Objective (RTO).
RPO defines the maximum period during which data loss is acceptable for a company. In other words, if a data loss incident occurs, the company could lose data generated during this time frame. Therefore, the frequency of backups is adjusted according to this period.
On the other hand, RTO specifies the duration that data or an IT system can be offline. After an incident, whether it is data, an app, a virtual machine, or an operating system, RTO is the timeframe within which these need to be restored.
The RTO and RPO parameters are tailored for each organization, depending on the type of data, its importance to the business, the cost of its restoration, and whether it is an application, a virtual machine, or an array.
A common oversight in backup system management is failing to update the system's rules and tasks regularly. As a company grows and its IT infrastructure evolves, the volume and variety of internal services, data, and applications increase. But often, the backup policies, which might have been set up months or even years earlier, remain unchanged. This neglect can lead to data loss risks, data integrity issues, or excessive downtime of crucial IT systems.
Backing Up More Than Just Files
Today, when ransomware is a significant threat, simply backing up important files might not be enough. There might be a need to restore entire workstations and systems to their previous, uninfected state. Ransomware can paralyze various critical services, including email and print servers, CAD systems, payment terminals, employee training and payroll systems, potentially halting business operations. To counter this, it is advisable to maintain backups or 'images' of their systems, which can be quickly deployed if the original systems are compromised. It is not necessary to keep multiple backups of each system. Using incremental backup solutions, which save only the latest version of a system, can be an efficient way to ensure you have the necessary data to revert to a clean state.
A Multi-Layered Backup Strategy
To enhance the protection and reliability of your organization's data, adopting a multi-layered backup strategy is recommended. Developing a multi-layered backup strategy involves a thorough assessment of your organization's infrastructure to identify the data, systems, and files that require backup. This process includes establishing dependencies among the information systems earmarked for backup.
The next step is to define the requirements for Recovery Time Objective (RTO) and Recovery Point Objective (RPO), which are critical in shaping your backup strategy.
Once the analysis is complete, you can determine the hardware requirements. This includes selecting appropriate storage systems, servers, tape libraries, and other infrastructure components. These decisions should be based on a detailed list of the information systems that need backup, along with considerations of storage location, the frequency of backups, and the types of backups required.
A cornerstone of this strategy is the 3-2-1 rule, which significantly reduces the risk of a single point of failure. The rule is simple yet effective: maintain at least three copies of your data, keep two copies on different types of media, and keep one backup copy offline. It is important to prioritize data, focusing on the most critical information. For offline backups, ensuring they contain the latest data version is vital.
Adhering to the 3-2-1 backup rule minimizes the risk of data loss from ransomware, hardware failures, or internal threats like disgruntled employees. This approach prepares your organization for worst-case scenarios, enhancing resilience against disasters from any source.
Further enhancing your backup strategy includes:
- Regular testing of backups
It is crucial to routinely test your backups to ensure they work as intended. This testing helps identify any issues in the backup process and confirms the reliability of data restoration.
- Network segmentation and air gapping
Segmenting your network and using air gaps (disconnecting backups from the network) can protect backup integrity. This reduces the risk of network-based attacks affecting your backups.
- Encrypting Backups
Adding encryption to your backups provides an additional layer of security. It ensures that even if the data is accessed without authorization, it remains unreadable and secure.
- Employee Training
Educating your staff about the importance of backups, best practices, and how to respond in case of data loss is vital. Properly trained employees play a vital role in maintaining the integrity of your backup systems.
Alex Vakulov is a cybersecurity researcher with more than 20 years of experience in malware analysis and strong malware removal skills.
No entries found