Best Practices for Data Backup and Recovery in the Age of Ransomware

The prevalence and pervasiveness of modern ransomware has resulted in the need for organizations to look beyond prevention measures to also focus on their capacity to recover from recent or real-time backups of critical data. Much too often, in the middle of a ransomware or malware attack, organizations learn that although they thought they had appropriate data backups in place, the backups turn out not to be a viable option for recovering the impacted data and applications. Several scenarios commonly occur that result in data backups being unavailable when they are needed most.

If an organization’s critical data is not recoverable from backups, the choices for restoring access and returning the business back to normal may be extremely limited. Many times, this situation may leave paying a ransom to cyber criminals as the organization’s only viable recovery option. Depending on several factors, including the type of ransomware and the size of the infected network environment, these options could be incredibly costly and even go far beyond the organization’s available cyber insurance coverage limits.

There are several considerations and steps that an organization can take to help ensure that critical data backups are available when they are needed following a ransomware attack.

The Value of Backing Up Critical Data

One of the main benefits of maintaining complete and readily accessible data backups is the ability for organizations to recover from ransomware attacks in the fastest and most cost-effective way possible. Having the right backups established and kept safe from attackers can greatly minimize overall business interruption time and associated losses. In the absence of working backups, organizations may be forced to negotiate with ransomware threat actors and ultimately be faced with paying a ransom of hundreds of thousands or potentially millions of dollars in order to obtain decryption keys and other instructions from the threat actor to allow access to critical data to be restored. Ransom negotiations often take several days and once the data is decrypted and made available, the organization may still have several days worth of necessary efforts focused on data recovery to ensure that the affected data has not been corrupted and is accessible to critical users as soon as possible. These recovery costs and any revenue loss as a result of the extended interruption would be in addition to the costly ransom payment.

Why Are Backups Often Not an Option?

There are several common scenarios that result in an organization’s inability to rely on backups to recover from a ransomware attack. Victims of an attack surprisingly often come to the unfortunate realization that their IT service provider never actually set up data backups in the first place or didn’t set them up correctly, leaving the organization entirely without any backup option. In other cases where data backups are available following an attack, they may not go back far enough in time to be considered a true recovery option. Conversely, an organization may find that data backups were occurring up to a certain time, but for some reason the backup process stopped at some point and the organization was never made aware. Again, in this case, such data may not be seen as a viable recovery option since critical data may not have been backed up for weeks or even months. Organizations at times fail to adequately map their critical data and dependencies and backup recovery options fall short for that reason. A more recent and growing trend in which data backups are not an option for recovery occurs when a ransomware attack itself is able to propagate across the organization’s network and ultimately access, and thereafter encrypt, the organization’s data backups. In more sophisticated types of attacks, intruders may move laterally within the network and destroy any available backups ahead of delivering ransomware into the environment. Both of these situations most commonly occur because the backups were not appropriately segregated from the rest of the network to prevent them from being accessed by an attacker.

Ensuring Successful Recovery from Backups

In light of the prevalence of ransomware attacks as well as their ability to propagate across networks, access sensitive data, make critical data inaccessible and demand increasingly higher ransoms, it is essential that organizations consider several approaches to ensure access to adequate data backups.  

Proactive Data Backup Preparedness Considerations:

• Data backups are not just an IT department or vendor issue. Ensure that the appropriate stakeholders across all of the business are consulted to determine how critical data is defined, where it exists, how it is to be stored and how it will be protected.
• Conduct a business impact analysis (BIA) to determine what data needs to be backed up, how quickly data backups of newly created data need to occur, how far back in time data backups need to go, how long data backups need to be retained, when data backups can be purged, as well as how different types of sensitive data such as personally identifiable information (PII) and protected health information (PHI) will be stored.
• Coordinate with internal or external IT resources to determine and configure the appropriate data backup approach. Most organizations will want to consider having multiple backup types, such as traditional local network server backups, cloud backups and backup tapes. For example, the “3-2-1 Data Backup Rule” states that organizations should have ‘3’ copies of their critical data (production data and 2 backup copies) on ‘2’ different media (disk and tape) with ‘1’ copy stored off-site (for disaster recovery). Business stakeholders should also consult with IT resources to determine what type backup architecture may be most appropriate, such as real-time, full, incremental, differential, or other.
• Ensure that the organization has the appropriate people, processes, and technology in place to ensure that backups were initially configured correctly, are currently functioning as intended and are monitored to ensure that they continue to occur as expected. Establish formal policies and procedures to validate that data backups are being done at correct intervals.
• Consult with internal or external IT resources to ensure that the organization’s data backups are appropriately segregated from the rest of the network or otherwise protected. Understand how the organization’s IT resources have established a network architecture that would prevent a cyber criminal from pivoting from the main network to where data backups are stored. Using off-line, air-gapped or immutable back-up storage will significantly increase the chances of a successful recovery from a ransomware infection
• Periodic “fail-overs” should be conducted in which the organization tests whether or not it can actually access critical data stored via backups, if ever needed. Quarterly tests are recommended.

This material is courtesy of  CyberChoice First Responder℠.