Why Traditional Backups Are No Longer Enough to Protect Against Ransomware

Citește acest articol în română

Unless you've been living under a rock, by now you must've heard of the term "ransomware". Maybe you've experienced an attack yourself or know someone, like a supplier or business partner who has. It's terrifying to think that a business, regardless of size, could be held hostage by some guy who lives on the other side of the planet.

If you've taken the necessary precautions, you're probably aware of the key ways to protect yourself: keeping systems up-to-date, configuring them following security best practices, training your employees, and, of course, regularly backing up your critical data. While this is solid advice, unfortunately, it's no longer sufficient on its own.

Ransomware authors have evolved. They know that more businesses are backing up their data, so they've turned to more sophisticated tactics to continue their lucrative criminal endeavors. In the past, ransomware would immediately encrypt your files upon infection. But modern ransomware often stays dormant for days, weeks, or even months. This stealthy approach obscures the initial attack vector and gives attackers time to explore your network, identify your backup solution, and then either delete or encrypt your backups along with your production data. In such cases, the only option left is often to pay the ransom—an outcome no one wants.

Defending Against These Evolved Attacks

The answer lies in the "three I's," a concept introduced by Dell Technologies in 2022. The three I's are Isolation, Immutability, and Intelligence — key principles for ensuring a resilient backup strategy.

Isolation

Isolation involves physically and logically separating your backup environment from your production environment. Ideally, your backups should be housed in a separate VLAN, protected by firewalls, and inaccessible from regular production workstations or jump servers. Additionally, service and management accounts should be isolated from the production domain—using local accounts or a separate active directory exclusively for backup administrators. The storage system should be on a different server than the backup server itself. This way, even if the backup server is compromised, the attacker won’t have access to the backup storage.

Immutability

Immutability ensures that once a backup is created, it cannot be altered or deleted—even by system administrators. While achieving true immutability is challenging (since physical access to storage can always result in damage), this is less of a concern in ransomware attacks, where criminals are typically far away. You can implement immutability in several ways:

• Cloud Object Storage: Many services, such as Amazon S3, offer immutability features, though retrieving data from offsite cloud storage can be slow.
• Deduplicating Storage Appliances: Solutions like Dell Data Domain offer immutability but often require additional licenses and come with high upfront costs.
• Linux Systems: Modern 64-bit Linux systems support immutability via the chattr command, though extra hardening is needed to prevent root users from overriding it.
• WORM Tapes: Write Once, Read Many (WORM) tapes are another option, though they come with the added complexity of tape management.

Intelligence

Intelligence involves using advanced tools, such as machine learning, to monitor and analyze your data, helping to detect anomalies before they cause serious damage. For example, Veeam employs YARA rules to identify suspicious behaviors, such as abnormal changes in file sizes or content during backups. When such activity is detected, a warning is triggered, giving you time to investigate and take action if necessary.

Final Thoughts

No security measure can guarantee protection against every threat. However, staying ahead of the evolving landscape of cyber threats and implementing best practices will significantly reduce the risk of your business becoming another ransomware statistic. By incorporating Isolation, Immutability, and Intelligence into your backup strategy, you can strengthen your defenses and ensure that your critical data is always protected.