Ransomware remains one of the most disruptive and costly cyber risks today. While true that many organisations have strengthened their perimeter defences, attackers have adapted by shifting their attention to the one asset companies rely on most during an incident: their backups.
Cybercriminals now routinely target backup systems first, knowing that if they can encrypt or delete recovery data, they’ll gain near-total power over the victim. It’s a development that exposes the limits of conventional cybersecurity strategy, and negates the purpose and effectiveness of teams’ disaster recovery practice and planning.
In a recent episode of the Tech Means Business podcast, Object First’s Anthony Cusimano said that 66% of organisations experienced at least one attack in the last two years, and in 96% of those incidents, attackers targeted backup data. In a modern digital business, where applications and data are tightly interconnected, a week of downtime represents lost revenue and significant reputational damage, not to mention the significant stress for the employees tasked with putting things right.
Why traditional backup immutability isn’t enough
The term ‘immutable backup’ is used loosely, yet as soon becomes clear, not all immutability is created equal. Sure, backup tapes can be taken offsite and stored away from digital tampering. But while tape (still) offers strong protection, it introduces other problems: long recovery times, media degradation, slow manual testing, and all the associated operational overheads. Modern businesses like to operate in real-time, so need faster, more agile immutable solutions.
If we read the marketing collateral from many technology vendors, it’s easy to find ‘immutable’ settings in software or cloud platforms, but these rely on controls available to administrators, and therefore by proxy, to the attacker. As Object First’s Andy French noted, if an attacker gains administrative access to a cloud account, they can disable immutability settings, encrypt buckets, and even delete accounts. Immutability becomes conditional, therefore, becoming a ‘feature’ that can’t be guaranteed. The conditionality creates a false sense of security, and causes massive issues when the worst happens.
The role of dedicated backup storage
Speaking on the Tech Means Business podcast, Andy and Anthony outlined the more assured concept of ’Absolute Immutability’. Here, no user, administrator, nor attacker can perform destructive operations on backup data, regardless of the credentials they possess. In fact, pentesters checking Object First’s systems were given every conceivable credential and still couldn’t delete or alter the data guarded by the Object First Ootbi!
Absolute Immutability relies on three principles. First, the S3 object storage protocol is used, providing baked-in immutability with Object Lock, protection at rest/in transit, and built-in versioning. Second, there must be zero time to immutability: backups must be immutable the moment they’re written, without any mutable landing zones or retrospective snapshots once a backup job is completed.Third, a purpose-built physical appliance – securely separated from the backup software to reduce the attack surface of the overall backup solution, and properly secured and updated by a single manufacturer to remove the risks associated with DIY solutions.
Machine speed, human stress
Even the strongest backup strategy is only as good as an organisation’s ability to recover quickly. Local, purpose-built storage in the form of the Ootbi reduces recovery times compared with cloud, massively so compared with tapes kept offsite.
There is a note of caution, however. Object First’s own research shows that 84% of IT professionals feel “uncomfortably stressed” by the prospect of an attack, feeling they’re in the firing line if a recovery fails. When disaster recovery systems are complex (therefore difficult to test regularly), organisations risk discovering their critical flaws after an incident. Regular testing and simple, reliable recovery workflows are as important as storage architecture itself.
Recovery planning in AI complexity
Large language models and AI-driven workloads consume and generate large amounts of data, so it’s hard for organisations to choose priorities: What should be backed up and how often. The safest approach is to back up everything, of course, but that requires the necessary storage capacity and commensurate recovery planning.
Whether an organisation chooses its backup subjects, or invests in enough immutable storage to back up everything, tabletop exercises that simulate massive system failure or insider threats are just as important to practice before things get business-critical.
The new baseline for ransomware resilience
Ransomware resilience has to begin with an assumption of breach. It needs an investment in fast and reliable recovery, an architecture that guarantees backup integrity, and the resources to train and practice recovery. Absolute Immutability is emerging as a pragmatic, necessary response to attackers who have learned to neutralise traditional backup layers.
In environments where downtime translates to financial loss and reputational harm, organisations relying on ‘conditional immutability’ are missing the point. Secure, purpose-built, and truly immutable backup systems will ensure that when the heart of the infrastructure is compromised, its valuable data assets remain intact.
Find out more about the Ootbi and Object First, and listen to the Tech Means Business podcast episode where these issues get aired in more detail.
(Image source: “stone, wall, textura” by bartoszjanusz is marked with CC0 1.0.)
Want to experience the full spectrum of enterprise technology innovation? Join TechEx in Amsterdam, California, and London. Covering AI, Big Data, Cyber Security, IoT, Digital Transformation, Intelligent Automation, Edge Computing, and Data Centres, TechEx brings together global leaders to share real-world use cases and in-depth insights. Click here for more information.
TechHQ is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.
