Prevention

Prevention and response to ransomware require a comprehensive strategy. It starts with education and awareness: Employees should be informed about the risks and trained in the detection of phishing attempts, which are often the first step in a ransomware attack. Technical controls are also crucial, including regular backups, the integrity and recoverability of which should be tested regularly. In addition, strong security policies and the use of security tools for detection and containment of threats are essential.

We do not need a strategy to discover ransomware. We need a recovery strategy. Backups are the last line of defense.

โคต๏ธ Backup Strategy

While many certifications prescribe extensive security measures, a crucial component often remains strikingly flexible: the backup strategy. Instead of imposing rigid requirements, institutions like the German Federal Office for Information Security (BSI) and the US National Institute of Standards and Technology (NIST) encourage companies to develop their own solutions tailored to their individual needs. Among the numerous options, two strategies stand out as shining examples: the 3-2-1 and the 3-2-1-1-0 backup strategy.

  • 3 copies of your data: Ensure you have three total copies of your data (1 primary copy and 2 backups).
  • 2 different media: Keep the copies on two different types of storage media or systems to minimize the risk of failure.
  • 1 Offsite backup: Store a copy of the data at a different location to protect against local disasters (e.g., fire, floods).
  • 3 copies of your data: Identical to the 3-2-1 strategy.
  • 2 different media: Identical to the 3-2-1 strategy.
  • 1 Offsite backup: Identical to the 3-2-1 strategy.
  • 1 Offline (or air-gapped) Backup: One copy should be stored offline to protect it from cyber attacks.
  • 0 errors in recovery: Constant checks on the integrity of the data and the possibility of recovery to ensure that no errors occur in an emergency.

๐Ÿง‘โ€๐Ÿš’ Backup Variants

To provide you with clear guidance, we present a concise overview of three central backup methods: Offline Backups, Immutable Backups, and Data-Only Backups. Each method offers unique advantages and challenges, from maximum security through physical separation to flexibility and efficiency in data backup. This table serves as a guide to understand the respective characteristics, benefits, and considerations of each strategy, helping you make the optimal choice for securing your irreplaceable data.

  • Tape Drives or Offline SANs
  • Maximum resilience against encryption
  • High overhead (low cost-benefit), therefore often no correct backup rotation in practice
  • Manual process, therefore prone to errors
  • By design unchangeable (Rubrik, Veeam)
  • Not deletable by admin rights
  • Practical solution
  • Disadvantage, planning necessary: Storage volume not flexibly changeable for normal operation
  • Faster than full OS backups
  • Servers can be set up again โ€“ data cannot
  • System can be compromised in the backup
  • Low RPO โ€“ since higher frequency possible (good)
  • Disadvantage: Higher RTO

โŽ” Backup Solutions

In today's digital world, protecting and quickly restoring data is more important than ever. Companies of all sizes rely on robust backup solutions to prevent data loss and ensure business continuity. In this context, certain technologies and providers have emerged as leaders. ExaGrid, Veeam, S3 Glacier, and Rubrik each offer unique features that set them apart from other solutions. Here is an overview of their key features and how they help companies manage their data securely and efficiently.

  • Landing Zone Architecture: ExaGrid's unique landing zone architecture enables faster backups and restorations by keeping a recent copy of the data uncompressed and ready.
  • Adaptive Deduplication: Incorporates a unique deduplication technology that reduces storage requirements and costs while maintaining high performance.
  • Instant VM Recovery: Veeam enables quick recovery of the VM, significantly minimizing downtime for companies.
  • SureBackup: Automated backup verification technology ensures the recoverability of all backups and replicas.
  • Cost-effective: Extremely cost-effective storage service for data archiving and long-term backups.
  • Vault Lock: Provides WORM (Write Once Read Many) storage to ensure data immutability.
  • Polaris GPS: Unified system for business-critical data across data centers and clouds.
  • Instant Recovery: Allows companies to work directly from backup copies without impacting the production environment.