World Backup Day: Experts Share Best Practices for Protecting Data

World Backup Day is an independent initiative to raise awareness of the importance of regular backups for both businesses and individuals.

With the ever-increasing risk from ransomware attacks and the challenges created by hybrid working environments, ensuring that data is backed up is more important than ever. 

Despite this, 21 % of people have reportedly never made a backup. With this in mind, EM360 spoke to several tech industry experts about their top four considerations for businesses wishing to safeguard their data in 2023.

A change of tactics from both sides

How businesses use, and store data has evolved rapidly over the last couple of years, ignited by rapid technological advancements that have been an asset for both the good and the bad sides. 

Terry Storrar, Managing Director, Leaseweb UK, elaborates: “Gone are the days of clunky external hard drives and floppy disks. Now, it’s all about the cloud. In fact, recent industry research found that the majority (66%) of respondents suspect the industry will see the end of on-premises infrastructure over the next two years.”

Neil Jones, Director of Cybersecurity Evangelism, Egnyte concurs that the most significant evolution is that companies can no longer view data backup strategy monolithically. He continues: “Rather, they need to balance a mature Business Continuity and Disaster Recovery (BCDR) program with lighter, more nimble backup approaches such as snapshot recovery.”

Technological innovation has also helped attackers find more eloquent ways around security, adds Jasson Gerrard, Director of International Systems Engineering at Commvault, which has meant data protection has also had to change significantly. 

“Previously, they would typically gain access to an organisation’s data and encrypt it so that employees could no longer understand it and it was of no business use. However, cybercriminals have recently changed tack and they are increasingly moving from encrypting the data to threatening to publish it.

This has wider consequences, such as reputational damage, financial penalties from the Information Commissioner’s Office, and potential loss of competitive advantage,” Gerrard summarises. 

The need for validation checkups

“Simply backing up data isn’t enough,” argues Roman Pavlyuk, VP of Digital Strategy at Intellias. “Regular validation checks should be conducted to ensure data is restorable, readable and available within a set time limit. Failure to do so can result in businesses being unable to access or restore their backed-up data when they need it most.”

Gregg Mearing, Chief Technology Officer at Node4, agrees that regular testing and monitoring are critical components of a successful backup strategy. 

“Understanding fully your Recovery Point Objective (RPO) and Recovery Time Objective (RTO) for your critical data will help you understand if backups are enough to survive a cyber attack or outage.

If it takes 4 hours to restore a key application, but your business can only tolerate an hour of an outage, you may have to adjust how the application is hosted to introduce more resilience or look at different backup methods to drive that RTO down,” finishes Mearing.

These validation checks can also support and ensure businesses can comply with GDPR requirements. “When customers or employees leave an organisation, all their data, including backups, must be deleted.

To ensure compliance, businesses must have flexible and controllable systems that can automate data removal without the risk of corruption,” explains Intellias’ Pavlyuk. 

3-2-1 rule - backups of backups

 Pavlyuk adds: “Don’t put all your eggs in one basket.”

“Backups should not only be stored on local servers. Organisations should also back up data in the cloud and ensure they have backups in multiple locations to minimise the risk of data loss. Furthermore, each data storage location runs its own risks so businesses should have multiple backups in each location.”

Mearing agrees, suggesting that “if you don’t have a good strategy in place a good place to start is to follow industry best practices around the 3-2-1 rule – 3 copies of your data, 2 media types and 1 offsite – but to drive even more reassurance the 3-2-1-1-0 rule adding in 1 copy of that data on immutable or air-gapped storage, and having 0 backup check failures.”

Terry Storrar highlights that a change of protection must come with a change in storage. He stresses, “more emphasis needs to be placed on protecting mission-critical data wherever it is located and ensuring business continuity. Thankfully, modern cloud backup solutions have the benefit of being suitable for businesses of any size. They allow for data backup from any server or device, anywhere with an internet connection.” 

Cybersecurity

Although the cloud offers a level of security, organisations must remember that the more strategies they implement, the stronger their defences will be. 

“It is thought that in over 60% of ransomware attempts the bad actors actively target backup data on your network as part of the attack. One of the core strategies for organisations to deal with ransomware is to simply restore from it, so if the bad actors can encrypt your backups, your entire recovery strategy is foiled,” said Mearing.

Gerrard agrees, adding “it is no longer enough to just backup your data, you need to stop cybercriminals from accessing your systems in the first place. An early detection system, such as cyber deception, will put organisations one step ahead of the attacker. Decoys are deployed to throw the attacker off course and lure them to fake assets, rather than the real ones. Organisations are alerted as soon as the attacker enters the decoy IT environment so security teams can take immediate action and isolate the asset.”

Pavlyuk suggests that organisations should use attackers' tactics against them. For example, where attackers use encryption to get businesses to pay requested ransoms, he argues that businesses should encrypt the data themselves to “ensure that their data remains protected even if it falls into the hands of an intruder.”

Pavlyuk reinforces, “it’s essential to remember that no matter how safe the original location may be, it’s always possible for it to end up in an unexpected location."

Prepare or pay the price

World Backup Day is an essential reminder of backups’ crucial role in safeguarding data. Whether a business owner or individual user, Hugh Scantlebury, CEO and Founder of Aqilla questions: “why not use this World Backup Day as the excuse to check and see if and where you need to take action?”

Intellias’ Pavlyuk reiterates: "Too many organisations still only consider backups after a data loss scare or something disastrous happens.

“Certainly don’t wait to find out the hard way!”  Aqilla’s Scantlebury concludes.