There must be a strategy for Backup and Recovery measures in place, with accompanying policy and procedures that are regularly tested to ensure stable operation.

Control Type: Administrative & Technical

Control Function: Corrective

Description: Backing up company data is not optional for organizations in today's threat landscape. A cyber incident is bound to happen at some point, and data needs to be backed up to lessen the damage done when that day does come. A reliable backup and recovery strategy can be the difference between being able to recalibrate from a crisis and going out of business permanently. In addition to being an overall good part of cyber hygiene, backups may be required for any of the following:

  • Legal requirements
  • Regulatory requirements
  • Contractual requirements
  • Mission requirements
  • Pre-established policies and guidelines

A backup strategy should start with the drafting and publication of a Backup Policy. This issue-specific policy outlines the need for backups in the workplace, as well as standards for their creation, storage, and use.

A backup policy should address the following:

  • Purpose of the policy
  • Stakeholders in the policy
  • Scope of the policy
  • Key terms, mainly technical and legal
  • Required frequency of backups
  • Requirements for backup storage and protection
  • Requirements for validating the integrity of backups
  • Requirements for destruction or archival of backups
  • Roles and responsibilities for the backup creation, storage, retention, and destruction processes
  • Retention period for each category of backup
  • Points of contact for issues relating to backups

Backup solutions are an issue that is an inch wide and a mile deep. There are thousands of different proprietary and open-source solutions that automate much of the backup process for the organization. For extremely small businesses with just a few desktop devices, old-fashioned methods such as burning data to Blu-Ray discs may suffice. Many vendors of cloud infrastructure and software offer built-in backup functionalities, such as OneDrive’s ability to sync user directories to Microsoft’s servers.

It is best to start small by identifying the basic types of backup:

  1. Full: Every piece of data stored on a specific device or platform is backed up. Essentially, a full backup freezes the data in time, allowing it to be easily restored to the state it was in at the time of capture.
  2. Incremental: Backs up ONLY the data that has changed since the last full backup OR the last incremental backup.
  3. Differential: Backs up all data that has changed since the last full backup. The more time passes since the last full backup, the larger the next differential backup will be.
  4. Snapshot: Snapshots are much like full backups in that they capture a resource as it exists at the point in time of the backup. Snapshots are specifically tailored to virtualized environments, with the idea being that users managing a hypervisor can take literal “snapshots” of the Guest VMS. The snapshots will include all settings, configurations, and data at the time of the snapshot.
  5. Cloud: A cloud backup stores data off-site in a third-party vendor’s infrastructure. The backups specifically can be configured in several ways, but the overarching idea is that they are stored in a “vault” of sorts on the selected cloud infrastructure. Think of the “sync” features present in programs like OneDrive.

In addition, there are several different backup methodologies that define how the backups will be made:

  • 3-2-1 Rule: This is a general and widely accepted standard for creating backups. In this strategy, 3 different copies of the backup are created on at least 2 different platforms, with at least 1 copy stored outside of your main facility. This could be implemented in several ways. A common approach would be to have one copy stored on a network server, a second copy burned to a Blu-Ray disc, and a third sent securely over the Internet to a cloud storage bucket. However, cloud storage is not necessarily required for the off-site component (although it's recommended). Instead, a second Blu-Ray disc could be created and taken to a secondary facility and placed in a locked safe.
  • 3-2-1-1-0 Rule: This backup strategy expands upon the previous rule. It offers better protection for situations such as a ransomware attack or backup media corruption. The same backbone is used: 3 different backups, 2 different backup media, 1 copy off-site. However, a fourth copy must be added with the immutable attribute turned on. The Immutable attribute is available on many cloud data storage and it prevents any sort of change to the selected data. This way, ransomware cannot seize the backup copy and modify it. If a platform with the Immutable attribute is not available, you can still comply with this rule by having the fourth copy always kept offline.
  • 4-3-2 Rule: If an organization relies primarily on Managed Security Service Providers (MSSPs) or other third-party IT vendors, then this rule may be the preferred route. In this strategy, 4 individual backup copies are created. They must be divided amongst 3 different locations, with 2 of them being outside your facility. For example, one copy could be stored on a hardened file server on your company network, a second stored on your IT provider’s network, a third synced out to a cloud storage solution, and a fourth stored on a local Blu-Ray disc.

The specifical technical methods of making backups is up to the organization, and is influenced by numerous factors including financial burdens, storage capacity, and manpower. It also often depends on the platform being backed up, as different network and data locations may work better with different backup methods. Some of the most common approaches to creating and storing backups are:

  • Tape Backups: data is stored on an array of tapes that must be rotated. Technology such as Linear Tape Open (LTO) provide large amounts of storage, several terabytes, per tape.
  • Network Storage: one of the most simple ways to backup data is pointing backups to a network location. In smaller organizations, this may be one or more Network Attached Storage (NAS) devices or file servers. Larger organizations often implement Storage Area Networks (SANs), which are large subnetworks of high speed shared storage. However an important caveat is that network stored backups can be vulnerable to the same cyber threats targeting company devices in the first place, potentially reducing their effectiveness. For example, ransomware targeting an endpoint system often propagates to its attached drives, including network locations, and encrypts them as well. This is why creating a second offline backup is imperative.
  • Cloud Backups: this approach is popular and easy to implement for organizations that already make heavy use of cloud platforms. Company data is synced out to cloud locations, either in real time or at specific intervals, creating digital offsite copies that can be restored from the cloud to endpoints in the event of a cyber incident.
  • Removable Drives: very small organizations that lack lots of money for cybersecurity may backup data directly to removable drives connected to systems, such as USB devices or external hard drives. This approach can be sufficient, although it runs the risk of having the removable devices compromised along with the systems they connect to. To make this backup approach secure, ensure that a chain of custody is kept for each removable device. The removable devices should have secondary copies made of them on a regular basis. For better security, the removable devices should be encrypted to ensure confidentiality when moved and stored,
  • Alternate Sites: one of the more complex and expensive, yet secure backup and recovery strategies is the use of an alternate site (hot, warm, cold, mobile) which serves as a secondary emergency location that an organization can move to and resume operations in the event of a crisis. An alternate site can be used to house copies of backups and even store real time mirrored copies of the organization's entire network infrastructure. Alternate Sites are addressed further in future documentation.
  • Snapshots: if an organization makes use of virtualization in its network infrastructure, it should ensure that it takes advantage of the snapshot capabilities built into most hypervisor platforms. This is a very simple feature that allows admins to create a point in time backup of a virtual machine that can be used for restoration at a future time.

For physical copies of backups, organizations must decide if they will be stored onsite or offsite. Ideally, both should be used. Onsite backups should be stored in a secure, locked room that is air gapped off from any network activity. A safe within a secure room provides a level of physical defense in depth. For offsite backups, organizations should contract with reputable storage firms that have proper physical and environmental controls in place to protect physical media. All agreements with this firm should be documented, and the firm should be made aware of who in the organization is authorized to access the organization's storage. Another backup storage opportunity involves signing a reciprocal agreement with another organization, preferably one that is in the same sector or has an established close relationship. The reciprocal agreement would authorize each company to store their backups on the other's premises.

There should be a designated Backup Operator in place in every digital environment. This employee is responsible for managing and rotating the backups, and is the chief person in charge of dropping off and picking up backup media from offsite locations. In classic tape backup strategies, they are known as the Tape Librarian. The backup Operator has the following responsibilities:

  • ensures secure transport of backups to all necessary locations
  • manages and supervises access to backup media
  • ensures 24/7 access to backup storage locations
  • serves as the first line of contact with offsite storage firms
  • initiates and oversees the recovery process during a cyber crisis that requires restoration from backups

There are several standard media rotation strategies that backup operators can use to manage the rotation of backup copies:

  • Simple: one tape for every day of the week and then repeat the next week. One tape for Mondays, one for Tuesdays, etc. Set of new tapes for each month and then archive monthly sets. After predetermined number of months, put oldest tapes pack into use.
  • Grandfather-Father-Son: four tapes for weekly backups, one tape for monthly backups, four tapes for daily backups. Scheme establishes a hierarchy. Grandfathers are the 1 monthly, fathers are the 4 weekly, and sons are the 4 daily.
  • Tower of Hanoi: five sets of tapes, each set labeled. A through E. Set A used every other day. Set B used on the first non A backup day and is used every fourth day. Set C is used on the first non A or non B backup day and is used every eighth day. Set D is used on the first non A, non B, or non C day and used every 16th day. Set E alternates with set D.

Once an organization has selected and implemented it's backup strategy, it needs to outline the Restore/Recovery procedures that will be initiated during an incident or crisis. The Recovery process usually requires coordination between backup operators, system owners, and department managers. The goal is to initiate and complete the recovery process as smoothly and securely as possible, preferably in the shortest timeframe. Organizations should regularly test their recovery procedures to ensure they function properly.