Better Safe Than Sorry: On the Secure Side with a Backup

A backup (German Datensicherung) is a copy of data with the intention of being able to restore it in the event of data loss.

The highest IT threat level Red proclaimed by the BSI caused total chaos in the security scene at the end of last year. Many administrators and IT managers worked extra shifts over the weekend to investigate the consequences of the Log4Shell vulnerability in their own systems and keep the damage as low as possible. Log4Shell is considered in retrospect to be one of the largest software vulnerabilities ever. The vulnerability in the Java logging library Log4j is so explosive because Java is included everywhere – in Amazon's AWS, in the Google Cloud Platform as well as in Apple iCloud, in Microsoft Azure, VMware, in products from Atlassian, Cisco, and Oracle, as well as in web services such as Wikipedia and Twitter. Attackers could remotely attack servers operating the corresponding Log4j version. Authentication was not necessary. It was easy to write arbitrary malicious code into a program's log. Thanks to the JNDI implemented therein, Log4j interpreted this externally originating code and executed it. Attackers thus succeeded in gaining complete control over the server and connected devices, stealing or manipulating sensitive information.

The case shows how widespread and simultaneously hidden security vulnerabilities can be. Although the IT industry did everything at the end of December to remove and secure affected systems, it is suspected that there is a large dark figure of systems that were compromised unnoticed. Attackers had plenty of time to exploit the vulnerability unnoticed before the gap was closed. The problem is that in this case, patching the Log4Shell vulnerability is not sufficient. Many seemingly secure systems may already have been taken over by intruders who are preparing targeted attacks with ransomware and extortion attempts.

Once the ransomware is executed, all data is gone.

Attackers increasingly encrypt the data of institutions in multi-stage attacks to demand a ransom. In the past year, the Federal Office for Information Security (BSI) observed an increase in criminal extortion methods. In particular, so-called Double Extortion was used, where threats of publishing stolen data are made in addition to encryption.

Attacks by malicious hackers or other information security incidents, such as data loss due to carelessness or technical defect, can no longer be ruled out. One can still protect oneself by handling data carefully and, following the motto "Better safe than sorry," backing up one time too often rather than one time too few.

Current developments should be taken as an occasion for everyone to dedicate themselves to their personal backup routine. Not only privately, but also in a professional environment, regular data backups are unfortunately still not a matter of course. According to the practice report of DsiN (Deutschland sicher im Netz e.V.), a quarter of the SMEs surveyed in 2020 did not perform any or only irregular backups. World Backup Day on March 31 draws attention to this disproportion annually. It is intended to remind people to regularly ensure the security of their own data. Define your own rhythm – and don't just think about backing up your data on March 31.

What should the data be protected against?

Before starting an arbitrary data backup, the question must first be answered as to what types of loss the data should be protected against. Although mirroring data, for example through a RAID system, contributes to the availability of data and systems, this is not a backup in the actual sense. Anyone using a disk mirroring and who accidentally deletes a file will delete this file on both disks, as the same operations are executed on both data carriers at the same time. Consequently, the use of a RAID system cannot replace the creation of backups. Threats such as fire, flooding, technical failure, theft, or loss also reveal some requirements for data backups: a backup should be stored on a high-quality data carrier at least at one other location sufficiently far away, which is secure from fire, water, and theft.

How fast must a restoration take place?

In addition to the question of what threats protection should exist against, it must also be clarified within the framework of Business Continuity Management (BCM) how quickly the backup must be restored and how large the maximum data loss may be. Two key figures play an important role here: the Recovery Time Objective (RTO) and the Recovery Point Objective (RPO). To illustrate both terms, two simple examples support us: If a service is operated on a server that is needed for the control of a plant, interruptions in the range of seconds or minutes can already cause high damage. The RTO is therefore very low. High availability, i.e., the ability of a system to ensure operation despite the failure of individual components, must be guaranteed by adequate techniques such as redundant service design and hot standbys.

The situation is different in the second example: Suppose we are talking about the central email server of a company that receives and processes customer inquiries via email. In the event of a failure, high costs would arise immediately, as no further customer inquiries could be accepted. The RTO would therefore be at most in the low hourly range. However, a potentially occurring data loss would lead to the loss of the orders currently being processed. Even the loss of data from the last 24 hours would therefore be very costly for the company. Backups would therefore have to take place at very short intervals to keep the frustration on the part of the customers and the losses of the company within limits. The RPO would therefore be assessed as low in this example.

How should data backups be rotated, stored, and deleted?

Once both requirements are clarified, most admins are immediately faced with the next hurdle: how exactly should data backups be rotated, i.e., created, stored, and deleted after their validity expires? In practice, the so-called generation principle or also Grandfather-Father-Son principle has proven successful. Here, several backup generations are maintained in parallel according to a certain scheme in order to achieve a possible far-reaching backup into the past and simultaneously keep the need for storage space and thus the costs within the range of the feasible. The generation principle can in principle be applied to all types of backups.

A simple example of a data backup according to the generation principle would be as follows: First, daily backups of the data, referred to as "son," are created and – depending on the determined RPO – provided with a certain retention period. At the end of each week, another weekly backup is created, which is referred to as "father" and is provided with a different, usually longer retention period. After four weeks, a monthly backup – the "grandfather" – is created, which in turn is kept for a certain period of time.

Especially the currently acute threat from ransomware makes the advantages of the generation principle clear. If the malware remains undetected and manages to encrypt several backups of the "son" or even the "father" generation, there is still a greater chance that an intact backup from previous weeks remains. Without the application of the generation principle, this would only be possible at high cost, as daily backups would have to be kept for a very long period.

The prerequisite for this is, of course, that backups were transferred to a server other than the infected one and that this was sufficiently protected from an attacker spreading in the network. The basis for this is a sophisticated network concept that, through sufficient segmentation and hardening of systems, ensures that attackers cannot spread unhindered in the company network. Backups should, similarly to the crown jewels, be accessible only to particularly privileged users.

Is the backup encrypted and functional?

The storage of backups in the cloud is enjoying ever-increasing popularity. More powerful internet lines and low prices for cloud storage allow the storage of data backups off-site (outside the location), whereby ensuring the confidentiality of the data becomes particularly relevant. Fundamentally, backups should be encrypted, especially if they are in the cloud. This prevents the data theft of backup data carriers and is anyway a frequent regulatory requirement.

All the effort for data backups is in vain if, in the event of a need, the restoration of the backups does not work. Therefore, it is important after the creation of a backup to check it for its consistency, for which the backup protocol provides important clues. Finally, only regular restoration attempts bring confidence in the backup process. In a restoration attempt on a test system, one can recognize whether all data is restored without problems, how long the attempt takes, and whether unforeseen problems occur.

Have you provided for the worst case?

Data backups are an essential component of a security concept . If data is destroyed by ransomware , a technical defect, or force majeure, this can have serious consequences. Clarify against which threats you must protect your data and how quickly a restoration must take place. Those who keep an eye on regular, encrypted, and restorable data backups are well-equipped for the worst case.