Ransomware and backup: Overcoming the challenges

Restoring from backups: The basics

Firms can take a range of steps to reduce the risk of a ransomware attack, from technical security tools, regular patching and operating system updates to user education.

If an attacker does gain access to the network and is able to encrypt files, the only option – short of paying the ransom – is to restore data from backups. But backups need to be “hardened” against ransomware attacks.

Options include restoring from offsite media, including optical or tape drives, or from snapshots. Snapshots contain more information than just the data, but include metadata, parent copies and even deleted files. These snapshots are now often referred to as “immutable”, as once copied they cannot be changed.

And backup security tool suppliers have added measures to prevent snapshots being wiped, for example, by requiring multi-factor authentication to move or delete the data. This provides added protection against malware that attempts to delete or corrupt backup files.

If possible, backups should be air-gapped, either physically separated from production systems or logically separated by the backup and recovery tool. Ideally, firms should use both strategies.

Organisations should also consider backup to the cloud, to provide a logical and physical separation. More backup and recovery tools now support storing immutable backups in the cloud. CIOs need to be aware of storage and data egress costs, although cloud can still be more cost-effective than building extensive, on-premise backup hardware.

RPOs, RTOs, and ransomware

Any disaster recovery plan will set out the organisation’s recovery time objective (RTO), or how quickly data should be restored, and the recovery point objective (RPO), or how far back the restore needs to go to find a clean, workable copy of their data.

In conventional disaster recovery planning, RTO needs to be as short as possible to minimise revenue losses, and RPO as recent as possible to reduce the need to reconstruct lost data. Quicker recovery means more frequent backups and higher storage costs.

Ransomware, however, complicates matters because attackers often wait for weeks or months after they have penetrated networks before they deploy the malware. The challenge this presents is knowing how far back you will have to go to find a clean copy of data. In practical terms, ransomware protection means keeping more data copies for longer, and ensuring those copies are protected.

Recovery window

Firms also need to consider the recovery window: how long it will take to retrieve and check backups, especially off-site copies, and then begin the restore process.

Backup systems are not designed to recover large volumes of data quickly, which is why organisations have a broader suite of disaster recovery tools, including snapshots and mirrored systems. But these can be as vulnerable to ransomware attack as the production copies.

The option to recover data to cloud instances rather than on-premise helps, but CIOs will need to prioritise key operational systems for recovery. This needs to be part of the recovery plan, and tested in advance.

“The key point of failure in data protection usually isn’t the backup, it’s the recovery,” says Bryan Betts, at analyst firm Freeform Dynamics.

He cautions that increasing complexity of IT systems, including cloud, hybrid and containerised workloads, makes it harder to bring systems back online.

Again, snapshots will help, but disaster recovery planners need to think in terms of priority business systems and business processes rather than storage volumes. One single RPO and RTO might not be enough, and firms are likely to need different objectives for ransomware recovery than for a simple technical outage.

Backup and recovery risks

Recovering data after a ransomware attack is more complex and more risky than recovery from a system outage or natural disaster.

The greatest risk is that backups contain undetected ransomware, which then replicate into the production system or recovered systems.

This risk is reduced by using air-gapped copies and immutable copies and snapshots, and keeping more copies than would be required for conventional backup alone. This requires a more cautious approach to data recovery, and one that can be at odds with the commercial pressures for short RTOs and recent RPOs.

Matters are made more difficult because there are no viable, fool-proof systems that can scan data for ransomware before it is backed up, says Barnaby Mote, managing director at backup specialist Databarracks.

“Before ransomware was a thing, replicating data from production systems to DR as quickly as possible was a sound recovery strategy for conventional disasters,” he says. “Now, with ransomware, it has the opposite of the desired effect, rendering recovery systems unusable.”

There are some techniques IT teams can employ before recovering files, such as file monitoring, which looks at whether encrypted backup has the same characteristics, such as size, as the original files. However, detecting such anomalies is still largely a manual or custom process that relies on the skill of the recovery and IT security teams.

Recovering data initially to isolated environments and running further checks will provide some assurance. But all these measures take time, and add at least one more step to the recovery process.

And, as Christian Borst, field chief technology officer at threat detection and response company Vectra, points out, recovering from a ransomware attack is about more than recovering data. Firms need to reconstruct the operational state of their systems as well as ensure data is clean.

“Creating backups of system and application configuration in addition to operational data is essential,” he says. “The most important aspect in this regard is to ensure the integrity and availability of these backups.”

A good data protection strategy is neither easy nor cheap, but it will help firms reduce the downtime caused by a ransomware attack, and could, with good preparation and even a degree of luck, prevent the need to pay a ransom at all.