The Great Data Protection Misnomer

Remember when data protection products were called backup software? Somewhere along the product marketing timeline, someone decided it would be a good idea to change "backup software" to "data protection."

This play on words has led to a lot of confusion, with organizations thinking that their so-called data protection software would be able to restore critical systems after a ransomware attack. Instead, they discover that not only did the ransomware encrypt their servers; it ruined their ability to recover from their backups and even destroyed the very data protection software used to create their backups.

The evidence exists in the city of Atlanta, Georgia, the Erie County Medical Center in New York State, the recent Baltimore ransomware attack and countless others that never made headline news.

A Horse Of A Different Color

Labeling a backup product as data protection may have worked years ago, but in today’s cyberattack-riddled world, this description no longer works or fits for the majority of backup products that continue to go by data protection.

When organizations attempt to recover following a ransomware attack and discover that their backups have been compromised and their backup software has been destroyed, many questions get directed to their data protection product representatives. “You’re providing data protection, so there must be some kind of security built in, right? What kind of protection have you actually provided for our data? So, you provide zero protection and only perform a backup, per the traditional definition of the word?”

These questions are just a few examples of an inquisition that comes after an organization is rendered helpless in its data recovery efforts following a ransomware attack. Imagine the surprise of a CIO when questioning his data protection solution provider about how this could have happened to a data protection product.

The marketing term “data protection” means something entirely different from the literal meaning of the words, and in fact, it really only provides data backup software after all. So, do not get caught thinking your backup software actually provides data protection when faced with something as destructive as an advanced persistent threat (APT) like ransomware.

Layers Provide Protection

You have probably heard that there is no silver bullet, or in other words, a single security product that can protect an organization from all cyberattacks. However, transformation is happening within companies and products through partnerships, mergers and acquisitions, and innovation, bolstering enterprise security. And so the bullets are getting stronger.

The cybersecurity challenge is a continual power-shifting game where, at any point in time, one side will have the advantage over the other until technological adjustments are made that shift power to the opposing side. But these days, the only way to have true data protection is through the implementation of layers of cybersecurity countermeasures, processes and procedures implemented within an enterprise.

And if you want true data protection, then you must take steps to actually protect the organization’s last line of defense when faced with a disaster: the enterprise backups themselves. Not taking steps to protect your backups is like playing Russian roulette (pun intended).

Bad Habits Can Negatively Affect Your Enterprise Health

The security and ultimate recoverability of the enterprise falls on the organization’s shoulders, and procedural changes are a must if you are ever going to turn to your backups to recover from a cyber disaster. Start with training users about things like social engineering or phishing, as well as voicemail phishing scams known as "vishing," since these scams are a primary technique the bad guys use to find their way into your organization.

Bad habits can cause bad things to happen, and when users are trained about the hazards of clicking on suspicious emails and links, the bad habit will become less likely. Make patching, updating and upgrading systems an urgent matter. The bad guys target systems with known vulnerabilities that have not been patched or updated. Do not allow complacency to impact your organization. Patch everything from operating systems to applications in a timely and consistent manner to prevent being taken advantage of because of something that could have been avoided.

Standard Operating Procedure For Disaster Recoverability

Review your backup and data protection solution to ensure it's providing your enterprise with security countermeasures and can also protect itself, as well as the backups it produces. Some products even back themselves up, so you can rest easier knowing that your schedules, scripts and configuration data have not been lost and you can bounce right back if they’ve been targeted.

Test your backups regularly and audit them often to ensure the last line of defense is there for your organization when you need it most. Your enterprise environment is constantly changing with temporary and production workloads, and not setting a process for testing your backups to make sure they’re matching your ever-changing environment is a recipe for disaster.

Additionally, don’t just store backups in one place on-premise and look to the cloud for a heightened security posture and much deeper cybersecurity countermeasures and even service-level agreements (SLAs) to meet your organization’s needs. These days, the cloud offers disaster recoverability with cross-region and cross-account attributes, adding layers of security and additional data protection and replication to match the most demanding of requirements.

If recovery point objective (RPO) and recovery time objective (RTO) capabilities are paramount, then look into a native-cloud backup engine that will outperform traditional, legacy data center backup products with scorching fast recovery times and elastic multiplicity of recovery points that can exist on a global regional scale -- something most organizations didn’t have the luxury of easily implementing and having at their disposal years ago.