Prioritizing data backup to defend against ransomware threats
Connecting state and local government leaders
IT leaders must develop a data strategy with security and recovery performance in mind.
There were nearly 200 million ransomware attacks globally in the third quarter of 2020 alone. Cybercriminals are evolving – no longer targeting just frontline systems, but recovery solutions and data backups. The consequences of these attacks are devastating, and agencies must consider platforms with security built in, as well as backup and recovery measures to prepare for ransomware attacks that target the last line of defense: data backups.
Recent guidance from the Cybersecurity and Infrastructure Security Agency
recommended that agencies should routinely backup systems, reinforce basic cybersecurity awareness and education and revisit cyber incident response plans.
As IT leaders focus on looming threats, they must develop a data strategy with security and recovery performance in mind -- to avoid system down time. Such a strategy helps prevent the devastating effects of cyberattacks that could reduce productivity, cost millions, threaten mission-critical work or interrupt essential citizen services.
There are a variety of ways agencies limit the impact of ransomware attacks:
- Keeping operating systems and technology stacks up-to-date to stay ahead of known exploits and vulnerabilities.
- Investing in cybersecurity through InfoSec training, network security audits and vulnerability testing.
- Controlling access to secure files and data through admin rights and privilege management.
- Backing up files through frequent snapshots and other data-protection methods.
Agencies should also keep two important things in mind when considering backup methods: reliability and speed of backup.
Not only does data require a backup, but needs to be protected from intentional deletion. The backup system needs to be simple, reliable and immutable. Immutability is the ability of a system to prevent changes or deletion of an object after it is created. Secondly, a backup system must also be able to restore rapidly in order to avoid major impact. Like data, time is extremely valuable when restoring from an attack. Failed backups, corrupted data and slow restoration hurt agencies even more. Evolving ransomware attacks that target backup data, backup catalogs and even storage array snapshots force agencies to go through the reconfiguration of backup solutions even before recovering the data. A modern data platform with protection for backups built-in is essential.
Agencies must evolve their expectations around backup and restore speeds. Backup storage must recover as fast as possible, and also must be done at scale. When a single database may require 10 hours to restore, recovering from a widespread attack could take months.
Agencies doing mission-critical work cannot afford that amount of downtime. Rapid restore is essential if agencies are to protect themselves against the effects of ransomware attacks. Recovery point and recovery time objectives ensure that they can avoid major operational and financial impact, protect critical data, and stay focused on the mission.
Rapid backup and recovery are essential and should be built on a foundation of a modern data experience – meaning storage should be easy to set up, manage and expand as well as integrate easily with existing backup software. Of course, it must be fast – restoring data and applications quickly enough to actually matter. It should also be seamless. This experience can span any protocol, any tier of service level and multiple clouds in a single environment. Lastly, it should sustain performance as data volumes increase.
Having consistent, real-time access to data is critical for agencies, and in the event of an attack, they must be able to recover data at scale, as quickly as possible. The backups themselves must be both valid and usable. Modern data protection is fast, simple, and cost-effective and can help prevent the devastating effects of cyberattacks that could reduce productivity, cost millions, threaten mission-critical work or create a lapse in essential citizen services.