August 9, 2023 By Jonathan Reed 4 min read

Backups are an essential part of any solid anti-ransomware strategy. In fact, research shows that the median recovery cost for ransomware victims that used backups is half the cost incurred by those that paid the ransom. But not all data backup approaches are created equal.

A separate report found that in 93% of ransomware incidents, threat actors actively target backup repositories. This results in 75% of victims losing at least some of their backups during the attack, and more than one-third (39%) of backup repositories are completely lost.

What makes one backup strategy better than another? It starts with immutability, but there’s much more to the story.

Ransomware continues to wreak havoc

According to a recent Veeam Ransomware Trends report, 85% of organizations suffered at least one cyberattack in the past 12 months. The report surveyed 1,200 IT leaders whose organizations suffered at least one ransomware attack in 2022. The participants included companies of all sizes from 14 different countries across APJ, EMEA and the Americas.

One of the most notable findings in the study is that team leaders are acutely aware of a disconnect between IT backup teams and security teams. In fact, 70% of backup administrators and 59% of security professionals believe team alignment needs either “significant improvement” or a “complete overhaul.”

Why do these teams sense a wide alignment gap? One reason might be that only 16% of survey respondents said they got their data back and avoided paying the ransom. Also, 21% paid the ransom and never recovered their data. Meanwhile, 59% paid the ransom to get their data back.

Backup repositories affected

According to the report, malicious actors targeted backups in at least 93% of attacks in 2022. And adversaries successfully penetrated backup repositories in 75% of attacks. Based on the study data, Veeam came to these shocking conclusions:

  • It’s 75% likely that backup repositories will be affected by a cyberattack
  • When affected, 39% of repositories become unusable
  • Nearly one-third (29%) of data restoration attempts are not viable.

Meanwhile, survey respondents estimated that it took them an average of 3.3 weeks until they considered their recovery efforts to be complete. And the reality is that some recovery efforts can drag on for months.

Read the ransomware guide

Making data recoverable

Less than 25% of ransomware victims stated that attacks did not affect their backup repositories. As per Veeam, the way these organizations achieve this level of backup protection starts with immutability or air gapping.

For immutability, 82% of those surveyed use immutable clouds, and 64% use immutable disks. Immutable cloud backup refers to a backup strategy where the backed-up data cannot be modified, altered or deleted for a specified period. It ensures the backup data remains intact and tamper-proof, protecting against accidental or malicious changes. Strict access controls and write-protection mechanisms can help prevent modifications to the backup files.

Air gapping can isolate a computer or network from unsecured or potentially compromised networks. It involves physically disconnecting the system or network from any external connections, such as the Internet or other networks. Isolating the system or network creates a barrier that makes it difficult for attackers to infiltrate or exfiltrate data. This means storing backup data on an isolated, offline storage medium, such as external hard drives, tapes or optical discs.

Even if your data backup doesn’t get lost, what if it gets contaminated? The Veeam report also noted that even with immutability tools in place, 56% of organizations run the risk of re-infection during restoration.

Data backup immutability plus scan

Immutable data backup supports the ability to create cyber-resilient, point-in-time data copies that cannot be changed or deleted through user errors, malicious actions or ransomware attacks. Immutability can isolate backup copies from production data, so if a cyberattack occurs, data can be quickly recovered from copies.

Truly comprehensive data immutability also automatically scans data copies for signs of corruption introduced by malware or ransomware. Scanning can help identify a ransomware attack soon after it’s launched. Data scanning also enables the identification of data copies that have not been affected by an attack. Equipped with this information, backup teams can quickly identify an attack in progress and recover a clean data copy.

Data immutability and scanning also help IT staff perform the forensic analysis required for incident assessment. From there, teams can formulate optimal recovery plans and determine the scope of recovery for files, databases or entire systems.

Reducing breach timeframes and impact

The Veeam report highlights the fact that data backups are only part of a solid cyber resilience plan. There are, in fact, four key elements to a robust backup framework:

  • Data Copy Immutability: This creates secure, point-in-time copies or snapshots of active production data that cannot be altered or deleted (immutable). Data copies are typically created in a separate storage environment from production.
  • Proactive Monitoring: Detects malicious patterns leveraging a number of data sources and analysis tools and techniques. This includes access logs, heuristics, correlation with logs from other systems such as network logs or server logs, network flow and packet data.
  • Test/Validation of Data Copies: Provides proactive detection of data corruption or reassurance that the copy is validated clean before any further actions.
  • Rapid Recovery: Includes forensic investigation of a problem to determine the recovery action, tools and procedures needed to identify the cause and scope of an attack. Recovery tools extract data from the backup copy and logically restore it to the production environment. This operation is critical to restoring data, files or systems back into production use if there has been an intended or unintended data loss.

Truly effective data backup

If organizations are going to invest in a backup strategy, it should be fully immutable and enable fast recovery from an attack. Data scanning and monitoring are key parts of the equation. Any data contamination should be detectable, which makes breach resolution faster and easier. That way, you can get your operations up and running faster, sometimes even within hours instead of weeks.

More from News

Zero-day exploits underscore rising risks for internet-facing interfaces

3 min read - Recent reports confirm the active exploitation of a critical zero-day vulnerability targeting Palo Alto Networks’ Next-Generation Firewalls (NGFW) management interfaces. While Palo Alto’s swift advisories and mitigation guidance offer a starting point for remediation, the broader implications of such vulnerabilities demand attention from organizations globally.The surge in attacks on internet-facing management interfaces highlights an evolving threat landscape and necessitates rethinking how organizations secure critical assets.Who is exploiting the NGFW zero-day?As of now, little is known about the actors behind the…

Will arresting the National Public Data threat actor make a difference?

3 min read - The arrest of USDoD, the mastermind behind the colossal National Public Data breach, was a victory for law enforcement. It also raises some fundamental questions. Do arrests and takedowns truly deter cyberattacks? Or do they merely mark the end of one criminal’s chapter while others rise to take their place? As authorities continue to crack down on cyber criminals, the arrest of high-profile threat actors like USDoD reveals a deeper, more complex reality about the state of global cyber crime.…

CISA adds Microsoft SharePoint vulnerability to the KEV Catalog

3 min read - In late October, the United States Cybersecurity & Infrastructure Security Agency (CISA) added a new threat to its Known Exploited Vulnerability (KEV) Catalog. Cyber criminals used remote code execution vulnerability in Microsoft SharePoint to gain access to organizations’ networks. The CISA press release states that “these types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.” However, Microsoft identified and released a patch for this vulnerability in July 2024. Cybersecurity experts…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today