When you think about your security strategy; firewalls, endpoint protection, insider threats, external attackers, malware and vulnerabilities all come to mind. It’s rare that your backup and disaster recovery (BDR) comes into the conversation. It’s probably that your organization, like most, thinks of BDR as being a business continuity thing and not a security thing.
But nothing could be further from the truth.
Your security strategy, no doubt, is a defense-in-depth model, where you have multiple solutions, initiatives, processes and policies in place – each one providing another tier of protection around your organization’s most precious data, applications and systems. But, with attack vectors like the ever-growing threat of ransomware – that if given the opportunity will turn the tables and keep you out of your own data – it becomes evident that you also need to know “can we recover if all this security stuff fails?”
So, where should you fit BDR into your security strategy?
Because you know the possibility exists that an external threat could get through, there are a few questions that will help identify where your current BDR needs to change while simultaneously fitting into your security strategy:
- What threats are you trying to protect from?
Different threats require different responses from BDR. If it’s malware infections (and, potentially external attackers), you should consider how you’ll recover the infected endpoints. If it’s more along the lines of ransomware and/or the threat of data manipulation or destruction, you need to be looking at how you’ll recover that data, how quickly and how much data can be lost.
- What data/systems/etc. are you trying to protect?
When you look at, say, your vulnerability and endpoint protection strategies and define what should be patched and protected, it’s equally important to align your backups towards those very same systems. A simple SQL injection on an unpatched system could result in massive corruption of the database.
- How do our security-based recovery needs change our BDR strategy?
Many organizations are focused on specific kinds of DR – the massive IT casualty, “the building’s on fire” kind of recovery. And with this focus comes a certain focus on how the environment should be backed up and, therefore, recovered. For example, using the disaster example above, it’s reasonable for an organization to use image-based backups and replicate those images to an alternate site hosting a standby virtual environment. But if, say, ransomware was to take hold and only encrypted all of the Word docs on a file server, you don’t need to recover the entire server; just those files. Sure, lots of image-based backups have the ability to mount the image and access the files within, but I think you see the point – you may need to modify your BDR strategy to incorporate security-focused backups. Also, you may have different RTOs (recovery time objectives) and RPOs (recovery point objectives) for security-related recovery, so keep that in mind as you’re planning.
It makes sense to have BDR as part of the conversation at the beginning of the security strategy discussion (so you are prepared for the worst). And, at the end of the day, should the very threat you’ve spent countless hours building a layered defense against have its way with your network, BDR becomes the last defense in your security strategy. By being able to turn back the clock to before an infection, before data was destroyed, before ransomware took hold – you place your network back into a secure state.