• Data Backups – Your last line of defense against Cyber Criminals

    Ransomware

     

    Ransomware is a form of Malware that, once activated, can deny access to files on smartphones, personal computers, and servers. In some forms, a Ransomware attack will go beyond denial of service; and the Cyber Criminals will threaten to publish your data. As the name suggests, Ransomware offers to unlock your files if you pay a ransom. While modern day Ransomware attacks can be traced back to 2005, the history of Ransomware goes back as far as 1989. The pace of these attacks doesn’t appear to be slowing down. In 2016, many sources had payouts approaching $1 billion by the end of the year.

     

    Computer hackerAs you might imagine, having been around for such a long time, Cyber Criminals have developed several ways to launch Ransomware attacks. Within the data center, our first goal is to keep these attacks out of our systems and away from our production data. IT Professionals protect their production environments by using firewalls, anti-virus software, proper authentication practices, and end-user education, among other measures.

     

    Despite these efforts, there is always the possibility that an attack is successful and systems are compromised. In the event our corporate files do become impacted by a Ransomware event, we must be able to rely on our data backups to restore systems and not be forced to pay a ransom. However, this begs an important question:

     

    How can we be sure that our backups are protected?

     

    This is a question that is being asked more frequently by our clients.

     

    First, we need to acknowledge that backups are not free from the risk of being attacked by Ransomware. However, there are steps that can be taken to reduce the risk of exposure, even if the Malware has found its way into the Production infrastructure. These steps fall generally into three categories: Security, Replication, and Isolation.

     

     

    Security
    • Provide a dedicated host for the backup application.
    • Disable network interfaces not in use on the hosts involved in performing backups.
    • Restrict the number of user accounts with access to the backup application and the host onto which it is installed.
    • Disable access to communications ports and protocols not needed for the backup operation (i.e., HTTP, FTP, Telnet, etc.).
    • Disable accounts not used for operation of the backup process.
    • Disable services not used for operation of the backup process.
    • Utilize best practices for user credentials (password complexity, aging, etc.).
    • Keep Security Patches up to date on the host and the backup application itself.

     

    Replication
    • Digital securityMaintain at least three (3) copies of the backup files on at least two (2) different types of media and keep at least one (1) of those copies offsite. (3-2-1 Rule)
    • Consider keeping a copy of your backup on tape or on spinning disk that is not connected to the network unless backups are running. The point here is to maintain an offline copy.
    • If replicating between backup appliances, consider building a delay into replication to keep from immediately replicating files infected with the Ransomware. This tactic may allow you time to discover the proliferation of an attack and keep it from spreading to your replication target.
    • Utilize hardware based snapshots on Production storage arrays and backup appliances (these are not usually presented to a file system and are therefore not subject to attack).
    • Maintain multiple restore points using snapshots and the backup software.

     

    Isolation
    • Maintain separate hosts for the backup infrastructure.
    • Utilize offline backup media (tape or disconnected disk targets).
    • Utilize hardware based snapshots.
    • Utilize Cloud connected backup targets.

     

    The steps listed above are intended to provide guidelines for protecting your backup data from Ransomware. Execution of these steps is dependent on your own infrastructure, the type of backup targets you employ, the backup software you use, etc.

     

    There are many resources available that delve into this topic in greater detail. The intent of this post is simply to make sure you are including backups in your strategy to protect the enterprise against Ransomware attacks. And, of course, Zunesis is ready to help you design a strategy that fits your needs and is right for your environment.

     

     

     

    Categories

  • Archives

  • Social

    • GET IN TOUCH

    EMAIL: info@zunesis.com

         

        

    NAVIGATION

    CORPORATE OFFICE

    Zunesis, Inc.
    12303 Airport Way, Suite 100,
    Broomfield, CO 80021
    (720) 221-5200

    Las Vegas
    6671 Las Vegas Blvd S
    Building D Suite 210, Office 260
    Las Vegas, NV 89119
    (702) 837-5300

    Copyright © 2023 Zunesis. All Rights Reserved. | Website Developed & Managed by C. CREATIVE, LLC