How to Secure and Protect Backup Data

Multiple high-profile breaches have made everyone acutely aware of the need for data security. The theft of unencrypted backup tapes from several major corporations has expanded the scope of backup to include protection. Unfortunately, IT departments have not done much to improve the security of cold data.

Attackers usually target active data and online systems, so technology experts and data security companies focus their efforts here. For years, businesses have avoided backup systems by chance rather than by effort. In the era of ransomware, this chance will dramatically diminish.

Risk Analysis for Backup

In previous articles of this series, we encouraged you to perform a risk analysis for your production systems. If you've done that, you already know the importance of the various items you back up. Much of this prioritization is directly transferred to your backup copies.

However, consider all your backup data as a single target. Large corporations often separate data in backups due to time or capacity constraints, but many of them combine everything into one place.

If you decide not to encrypt backups of data that has no value to a thief, like documents you've made publicly available, an attacker may find a way to use your encrypted data as a chisel against your defenses.

When considering risks to your backup data, don't forget one of the main reasons why backups are part of your disaster recovery solution: they can help you recover from physical loss or damage to your data in production systems.

Geographic distribution provides a direct answer to these concerns. A suitable protection system keeps at least part of your backup data far away from your primary site.

Different geographic locations face unique threats. Coastal facilities may suffer damage from hurricanes. Dense forested areas deal with more fires. Inland plains deal with tornadoes. Dense urban areas may go through destructive civil unrest periods or worse.

Think about how your business continuity system protects you from the realistic threats you face. Ransomware has added itself to the list of threats targeting your backup data. As writers expand their intelligence and attacks, they can directly interfere with your backup systems.

Ransomware Risks for Backup

Ransomware creates a unique challenge. In traditional attacks where your data is either stolen or destroyed, ransomware tries to prevent you from accessing it. Standard disaster recovery techniques easily handled early ransomware. Managers would completely wipe the live system and rebuild from the last backup.

Since ransomware has proven to be a uniquely profitable vector for malicious actors, it has received more development effort. In the early iterations of these types of malicious software, they spread by following virus and worm techniques, but newer programs can specifically target backup software. If they are not caught, they encrypt all the data they can reach. Such a risk should affect your backup distribution.

Backup and Security

We use backups primarily to create a separate copy of our live data. To strengthen this protection, we need more redundancy in our backups. Each unique copy significantly reduces the probability of permanent loss.

Protecting Your Backups with Multiple Layers

As technology advances, storage costs per terabyte continue to decrease. You can take advantage of this to create backups of your backups. Although your rotation schemes and full backup timing schemes can prevent the devastating loss of data from single points of failure, they do very little to protect only the data found in a single backup.

There are several ways to solve this problem:

• Multiple copies made by your backup software in separate locations
• Replication of backup data using built-in NAS/SAN features
• Replication of backup data using external software

You can use multiple approaches suitable for your needs and the technology you can use. For example, you can have your backup software place its data on a NAS and then use a storage replication technology to copy it to another system.

An older solution called disk-to-tape involves keeping the latest data on tapes and using backup software to transfer it to disk later. If possible, try to use the features of your backup software. If someone has to take over your distribution after you leave, you would prefer them to do so with the least possible complications.

You don't want a complicated system that complicates your maintenance activities while you have control.

The Role of Retention and Rotation Policies in Backup Security

Retention policies themselves don't affect redundancy. However, they determine how long you can extend your media. If you have very long retention policies, you'll need more media capacity to achieve the same frequency of full backups.

Rather than sacrificing sufficient full backups, prefer to shorten your retention policy.

To make the best use of your backup environment and storage space, you'll create a rotation application to reuse it. If you have a tape-based system, you could prefer a scheme that reuses some tapes but keeps others for long periods.

If you use a disk-based system, you can switch between removable drives or keep some backups out of the rotation process at regular intervals. Use these techniques to balance media consumption economics with the value of full copies.

Rotation can really shine when used as a defense against malicious software. If malicious software affects your backup solution, the program will encrypt everything it touches. Only your offline media remains secure.

You need to be careful with your backup solution so that someone can catch infections before they go through your rotation.

Using Account Control to Protect Your Backups

Backups have a special role in your information technology environment, but they have the same basic requirements as all your other systems. Thus, you can apply common security practices to them. Start by creating a unique account to run and lock backups. Limit the permissions for handling backup data.

If your backup application allows it, consider using different accounts in different contexts. Exercise restrictions; Don't create an unmanageable mess. Follow the same practices you apply to all important service accounts:

• Provide strict control over the account and treat it like a domain administrator account
• Place the account in an organizational unit that grants access to the least number of people possible
• Assign appropriate password rotation and complexity policies
• Immediately change passwords if anyone with access leaves the organization
• Use a securely configured password vault

These practices won't provide much protection against ransomware. If malicious software recognizes your backup program and attacks it, you can reduce the damage by disabling special backup accounts. However, if malicious software has already infiltrated your organization up to this point, such an action will almost certainly be too late.

You should spend time securing accounts properly, but don't waste time developing overly creative solutions that burden administrative staff more than the protection they provide. In later sections of this article series, we'll explore ways to create an effective defense against ransomware that is sensitive to backups.

Encrypting Your Backup Data

You can easily reduce the risk of your data falling into the wrong hands by using encryption. If someone steals a tape or gains access to your cloud account, they won't be able to do much if they find encrypted data without the key. All modern backup software should include some form of local encryption. Avoid those that don't.

When you test the software, make sure you understand how it applies encryption. If you want to rely on the application's deduplication and other storage-saving features, compare how encryption affects them. While encryption significantly strengthens the security of your backups, don't rely on it alone. If someone steals a copy of your encrypted data, they have a copy of your data. If your attacker is skilled, has time, and is motivated, they'll eventually break even the best encryption with long keys.

We expect it to take years for anyone to crack current cryptographic schemes, but we can't know which security vulnerabilities remain hidden or how recent technological advances might affect code breaking. Take all existing security precautions.

Don't forget to pay special attention to the keys used for encrypting your backups. They represent the weakest links in this strategy. Use techniques similar to those you apply for important account passwords to protect them.

Discovering Immutability

The data protection industry has renewed its interest in immutability. To some, it may seem like a new concept. However, the intent and technology for achieving immutability have been around for a long time.

If you want to know the past, search for WORM (Write Once, Read Many) storage. However, recent emphasis on immutability by backup solution vendors is not just a gimmick to sell more technology. WORM technology has been around for a long time because managers have always needed to preserve the integrity of long-term storage. However, most past threats targeting static data came from internal sources.

Innocent, accidental overwriting of media has caused more damage than malicious attacks. What brought immutability back into focus was the increasing meticulousness of malicious software writers. Especially ransomware, has gained the ability to recognize and sabotage specific backup applications and technologies.

Attackers are as aware as anyone that a rollback can reduce a catastrophic outage to a mere disruption. These disruptions can destroy days, even weeks for the targeted organization but don't lead to ransom payments. For this reason, threat actors attack backup systems along with the live environment.

Now you need to worry not just about accessible data but also about backup and restore operations. Immutability helps solve the problem of attacks on backups. Immutability tools prevent any changes to data, forcing administrators to rely on defense techniques and tools rather than trusting the data itself. This block includes the backup software that creates the backup.

Modern Immutability Solutions

Original WORM solutions used optical disks. Even today, nothing matches the permanence of a laser changing a material surface. Unfortunately, optical media lacks sufficient capacity for most applications today. To solve this problem, vendors have created several alternatives.

Many removable magnetic media have write protection mechanisms. Tape has emerged as the last remaining media in this area. Usually, an operator needs to physically move a sliding plastic piece or break a tab. Some manufacturers provide tape cartridges that automatically switch to write protection mode after the first write operation. Tape drives have their own physical mechanisms to detect write protection mode. Only someone with physical access can bypass or circumvent these systems.

Some SAN vendors enable WORM facilities. Usage depends on the device's architecture. Only someone with administrator access to the SAN can disable protection.

Ransomware has motivated backup software vendors to innovate. Details vary between vendors, but most include cooperation between software and cloud providers. For example, Hornetsecurity's VM Backup V9 uses existing cloud storage mechanisms to integrate with cloud immutability offers. Once the policy is set to immutability, administrators cannot change data until the policy's duration ends. This power allows us to provide the same level of protection as original optical WORM solutions without capacity limitations.

Isolating Your Backup Systems

Take steps to reduce the surface area of your backups. In some way, you touch everything in your backup environment, but it doesn't have to be the other way around. Isolation techniques range from simple to very complex; you'll need to balance the risk of not using a method against the effort of implementing it.

To properly protect your virtual environment and all data, use Hornetsecurity's VM Backup to securely back up and replicate your virtual machine.

For comprehensive guidance, get our indispensable resource that contains invaluable information about backup and disaster recovery: the comprehensive Backup Bible now.*

Final Thoughts

In an era dominated by the ever-evolving threat of ransomware, relying on chance to protect your backup systems is no longer valid. The potential consequences of a security breach can be catastrophic, leading to significant data loss and operational disruptions. Therefore, as Hornetsecurity, we call on organizations to adopt a proactive approach to secure and protect backup data to ensure comprehensive data security.

Source: How to Secure and Protect Backup Data - Hornetsecurity