The limits and risks of backup as ransomware protection

Backups at risk

As Lock suggests, when organisations deal with a ransomware attack, one of the greatest risks is reinfecting systems from a compromised backup. Some of the industry’s tried-and-tested backup and recovery and business continuity tools offer little protection against ransomware.

Snapshots record the live state of a system to another location, whether that is on-premise or in the cloud. So, if ransomware hits the production system, there is every chance it will be replicated onto the copy.

Conventional data backup systems face the same risk, copying compromised files to the backup library. And malware authors are adapting ransomware so it actively targets backups, prevents data recovery, or immediately targets any attempt to use recovered files by encrypting them.

Some ransomware – Locky and Crypto, for example – now bypass production systems altogether and go straight for backups, knowing that this puts the victim at a real disadvantage. This has forced organisations to look again at their backup strategies.

Immutable backups

One option is to use so-called “immutable” backups. These are backups that, once written, cannot be changed. Backup and recovery suppliers are building immutable backups into their technology, often targeting it specifically as a way to counter ransomware.

The most common method for creating immutable backups is through snapshots. In some respects, a snapshot is always immutable. However, suppliers are taking additional measures to prevent these backups being targeted by ransomware.

Typically, this is by ensuring the backup can only be written to, mounted or erased by the software that created it. Some suppliers go further, such as requiring two people to use a PIN to authorise overwriting a backup.

The issue with snapshots is the volume of data they create, and the fact that those snapshots are often written to tier one storage, for reasons of rapidity and to lessen disruption. This makes snapshots expensive, especially if organisations need to keep days, or even weeks, of backups as a protection against ransomware.

“The issue with snapshot recovery is it will create a lot of additional data,” says Databarracks’ Mote. “It will work, but has a large impact on the storage you need, and there is the cost of putting it on primary storage.”

Air gaps

Another way to protect against ransomware is to “air gap” storage, especially backups. In some ways this is the safest option, especially if the backups are stored off-site, on write-only (WORM) media such as optical storage, or even tape.

“Personally I like air gaps,” says Freeform’s Lock. “I’d like the backup to be on something that is totally air-gapped – take a copy on tape and put it somewhere. Preferably with logical and physical air gaps.”

The disadvantage of air gaps, especially physical air gaps with off-site storage, is the time it takes to recover data. Recovery time might be too long to ensure business continuity. And if IT teams have to go back through several generations of backups to find ransomware-free copies, the cost of recovering lost data can be high, maybe even higher than the cost of the ransom.

“Time to restore, at scale, is now key,” says Patrick Smith, field CTO, Europe, Middle East and Africa (EMEA) at Pure Storage. “This may mean specific solutions for the business-critical applications that need to be online first.”

Suppliers are trying to work round this through virtual air-gapped technology, which allows backups to be stored on faster local (or cloud) storage. But for businesses with the most critical data, it is likely that only fully immutable and air-gapped backups will suffice, even if it is as a second or third line of defence.

Defence in depth: backups and security tools

However, CIOs are also looking to augment their backup tools with security measures aimed specifically at ransomware.

Perhaps the greatest risk to an organisation with a solid backup policy is unwittingly re-infecting systems from ransomware hidden in backups.

Firms need to put measures in place to scan backups before they restore to a recovery environment, but again this takes time. And malware authors are adept at hiding their trails.

Anomaly detection is one route suppliers are exploring to check whether backups are safe. According to Freeform Dynamics’ Lock, machine learning tools are best placed to pick up changes in data that could be malware. This type of technology is increasingly important as attackers turn to double- and triple-extortion attacks.

“You need to make data protection, observability and checking for anomalies a continuous process,” he says.