Backup and disaster recovery
We review or design your backup system so that after an incident you can actually restore from it, not just according to the backup log.
When you need it
Where backups let you down
Most organizations believe their backups are fine, right up to the first real restore. The problem usually surfaces at one of these four points.
Inside the same domain
The attacker gains domain admin rights, finds the backup server, deletes the snapshots, and only then starts encrypting. If the backups can be reached with the same credentials, every copy is lost at once.
Successful status, incomplete data
The backup job reports success, yet the restore reveals that database consistency is missing, folders were skipped, or an encryption key has expired.
What the backup leaves out
Without the firewall rules, network configuration, domain settings, and certificates, a full recovery has nothing to restore the data onto. The restore documentation is no use either if the only copy sits on the system that needs restoring.
No agreed target time
IT thinks a daily backup is enough, while the business expects everything to be back within hours. The middle of an incident is a bad time to find out that neither is true.
Design
What lets a backup survive an attack
The 3-2-1 rule calls for at least three copies of the data, on two different media, with one copy off-site. It is still a good answer to hardware failure, fire, and theft, but it does not account for a targeted attacker. That is why it has been extended to 3-2-1-1-0: one offline or immutable copy, and zero errors in a verified restore.
The 3-2-1 rule todayImmutable copy
Until the retention period expires, nobody can delete or modify it, not even with administrator rights. You can implement it with object locking on storage or in the cloud, or with tape that an attacker cannot reach over the network.
Separate authentication domain
The backup system is not a member of the corporate domain. It is accessed with its own credentials that are not used anywhere else, plus multi-factor authentication.
Tested restore
A real test restores a business-critical system into an isolated network segment, measures how long it takes, checks that the data is complete, and records where the process got stuck.
Deliverables
What you get at the end
Ongoing operation after the rollout is available under a custom agreement.
items handed over
- Technical audit of the current backup system
- Immutable backup design in line with the 3-2-1 rule
- Actual restore test
- Disaster recovery plan with target times and roles
Related services
What comes before recovery and what complements it
Backups are worth the most when the attacker never gets to them, and when there is someone to lead the recovery if things go wrong.
Incident response retainer
Contractually agreed availability in case of a security incident: remediation, containing the spread, and recovery.
Active Directory review and hardening
The first target of ransomware attacks. Cleaning up risky permissions closes off the path to domain admin rights.
Network segmentation
Splitting the flat corporate network into zones so that an infected device cannot reach the whole network, the backup infrastructure included.
IT security assessment
If you would like to see the full picture first: the assessment examines your environment from access management through updates and backups to the network.
Frequently asked questions
The questions we hear most
Who decides how much data loss and downtime is acceptable?
Two metrics describe this. RPO (Recovery Point Objective) sets how much data loss is acceptable: if the backup runs once a day, a full day of data can be lost. RTO (Recovery Time Objective) sets how quickly the service has to be back after an outage. Both need to be defined together with business leaders, and the target times in the disaster recovery plan are built on them.
Do backups protect against ransomware?
Good backups let an organization recover without paying. Today's attackers, however, exfiltrate the data before encrypting it and use the stolen data for extortion too. Backups do not protect against this. Other controls stop the intrusion and the spread; we covered them in our article on ransomware protection.
Does data stored in the cloud need backing up too?
Many people assume the cloud provider takes care of backups. With most providers, though, responsibility is shared: the infrastructure belongs to the provider, the data to the client. As a result, mailboxes, file shares, and cloud application data often have no backup at all.
What needs backing up in an industrial environment?
In an OT environment, the PLC programs, the HMI projects, and the configuration of the engineering workstations. In many plants the backup is a years-old file on an engineer's laptop, even though these belong in an offline copy. We describe our services for industrial environments on the OT services page.
