Backup & Recovery

Description

A backup strategy should include multiple copies at different locations, including at least one that is physically or logically separated from the production network. This protects against ransomware that attempts to encrypt backup copies as well.

Equally important as creating backups is regular recovery testing. A backup that cannot be reliably restored within a reasonable timeframe has limited value.

What people often say

• Having a backup is enough; it does not need to be tested.
• Cloud backup is automatically protected from ransomware.
• Backup replaces the need for security controls.

Covers / does not cover

Covers

• Data recovery after ransomware attacks, disasters, or human errors
• Ability to restore systems to a known good state
• Protection against permanent data loss from destructive attacks
• Reducing business downtime after an incident

Does not cover

• Attack prevention or threat detection
• Data confidentiality (backup preserves data, it does not protect it from theft)
• Recovery from compromise embedded in the backup itself