A false sense of security
As ransomware evolves, backups have become the last line of defence, and the hardest to get right.
The importance of robust backup and disaster recovery strategies is underscored by the findings of Kaspersky’s Compromise Assessment, which showed that up to 40% of web shells were found hidden within backups. Senior cloud and systems administrator at Dariel, Mandi Pietersen, emphasizes that the efficacy of a backup strategy is determined by its ability to restore the necessary systems within a tolerable timeframe, rather than merely the successful completion of backup jobs.
Pietersen stresses the necessity of performing restore tests that go beyond confirming server functionality to ensure that applications work correctly, services start as expected, dependencies function properly, databases connect accurately, authentication is functioning, network settings are correct, and users can access the system normally.
These tests should be conducted in a sandbox environment that is realistic enough to be meaningful and should be carried out quarterly for critical systems and once or twice a year for all other systems, with documented outcomes detailing the recovery time, affected staff, and the current backup strategy's ability to support the business's expected recovery time objective (RTO).
Richard Ford, Group CTO at Integrity360, reiterates the critical role of backups in business continuity plans, not only for testing their functionality but also for verifying the organization's capacity to operate during catastrophic incidents. Ford warns that without immutable backups, especially for critical data, businesses are at significant risk.
He highlights the importance of understanding the exact point in time when systems were compromised to ensure a safe rollback and advocates for maintaining multiple restore points to provide a historical view and prevent the restoration of compromised systems. Ford suggests incorporating air-gapped or immutable backups to safeguard against ransomware attacks and stresses the need for multi-layered security measures, including dedicated accounts, separate subscriptions, locked-down identities, and multi-factor authentication to fortify backup protection.
While advocating for comprehensive backup strategies, Ford also points out the pitfalls of trying to recover all data simultaneously, advocating instead for a focused approach that identifies the minimum systems required for operation, understands dependencies between them, and restores them in priority order. He emphasizes the need for a recovery time objective (RTO) that is both meaningful and validated through successful recovery testing, aligning with the principles of the PoPI Act and GDPR, which require organizations to retain personal data only as long as necessary.
Ford concludes by acknowledging the evolving nature of data, suggesting that backups must be considered part of a broader security strategy, ensuring that encrypted backups are protected long after the systems they were intended to recover have been decommissioned.
Written by urgent.news from ITWeb's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
