Storing backup copies is one of the best ways to preempt losses from a cyber-attack. After a compromised system has been cleansed, unadulterated backup data can be loaded onto the production system and operations resumed.
Organizations have relied on backups for decades. Many different approaches have been employed. Data copies have been saved to storage devices and/or removable media at the production site, at remote company offices, at third party facilities such as colocation data centers, and in the public cloud.
Other variables associated with data backup include the breadth of the data that is stored and the frequency at which backups are made. One or more files may be copied, or entire disk images can be recorded. Some organizations make backups once a week while others do so every few hours.
Recommended Industry Practice
Different data backup approaches reflect the value organizations assign to their data and how costly they believe a potential breach might be. Recommended industry practice is to follow the 3-2-1 data backup model. This model advocates keeping 3 copies of important data (the original data and two copies), stored on 2 diverse types of media, with 1 copy kept at a different location.
Many organizations do not adhere to recommended data backup practices. They limit their investment in data backup software and systems, leaving themselves exposed to potentially severe and costly disruptions to their business operations. This practice is risky but quite common.
These days most companies make copies of their data to the cloud. Cloud drives such as Microsoft One Drive, Google Drive, Apple iCloud, and Dropbox are popular, inexpensive, and easy-to-use. These services provide automated remote file synchronization and storage. However, they do not offer advanced data backup and restoral functionality. As such, the many organizations that rely on these low-cost services risk not being able to recover all their valuable data if they are breached.
Though data backup is essential to remediation after a cyber-attack, it is not the whole story. Once an attack has been identified, the first step is to restrict further unauthorized system access. Then malware must be removed from those systems that were infected. Finally, clean data is uploaded from backups to the sanitized production systems.
Recovery Versus Restoral
Data recovery is when select clean files are uploaded to the repaired production system. Data restoral is when complete disk images are copied from the backup system to the production system. In some cases, data recovery of a limited number of files may be the most expeditious way to resume operations. In other cases, restoring complete disk images may be required to resume operations effectively.
Software as a Service (SaaS) is a cloud-based application delivery model that is used by most organizations. Whether a company is using Microsoft 365, Salesforce, or any of the thousands of available SaaS applications, data backup from the cloud must be addressed. Though some data is stored by these applications, SaaS subscribers often must supplement the basic storage offered to be sure they are able to retrieve critical data in the future.
Cloud Is Not Enough
Though cloud-based backups are cost-effective, convenient, and easy-to-use it is important for companies, both small and large, to understand the risks they are taking if they adopt a cloud-only backup policy. Supplementing cloud backup with storage of another backup copy at an alternate corporate facility or a colocation data center such as CAPS in Shelton, CT will increase the chances of successfully recovering from ransomware or other cyber-attack.
