Carlos Sandoval Castro explains why ransomware is forcing the golden rule for backup to move from the 3-2-1 approach to 3-2-1-1-0; and why tape can play an important role.
Already the bane of cybersecurity teams worldwide, ransomware incidents are predicted to increase over the next two years. A report from NCSC equates this with the growth of AI tools. It concludes AI will lower the barrier of entry for cybercriminals, increasing the number capable of carrying out attacks. What’s more, it says this will boost their reach and effectiveness by improving the scale, speed, and sophistication of ransomware techniques and availability of as-a-service options.
With over 59% of organizations experiencing an attack last year according to a report published by Sophos, the odds of becoming a target in the near future are shortening and the costs are getting higher. The research cites that 63% of victims received a ransom demand for $1 million USD or more, and average payouts increased five-fold over the last year, from $400,000 to $2 million.
While extortion using this method is nothing new, security professionals are realising that established recovery solutions are falling short of the mark when it comes to surviving ransomware. In the midst of an incident, many victims found it difficult, if not impossible, to restore missing data and maintain business continuity.
Until recently best practice advocated following what’s termed a 3-2-1 approach to backup. This refers to holding three copies of data including the original set, on two different types of media, plus ensuring one copy is held offsite. Typically, these two different backup media types include disk, tape, cloud storage, or solid-state drives (SSDs).
On the face of it, such a mix seems robust and comprehensive. But it does have drawbacks if copies of data remain connected, in any way, to a network. This is the case for organizations relying on cloud services, or hyper-converged infrastructures where computing, networking, and storage are consolidated into a single system. While these approaches streamline operations, they also create greater risk of widespread failure if ransomware breaches cyber defences at any point. Once inside, ransomware can spread swiftly across an integrated infrastructure, encrypting vast amounts of data, bringing down services and paralysing systems.
This extends to backups too. Some variants may even have a delayed activation feature, meaning backups and archives aren’t encrypted immediately, giving the illusion that data copies have remained untainted until it is too late to rectify.
Not just offsite, but offline too
To stop ransomware crossing into backups, the 3-2-1-1-0 approach to backup is the new rule, replacing the 3-2-1 method. The additional 1 in the 3-2-1-1-0 rule stipulates that a copy of critical data should be kept offsite and, crucially, offline. This is known as air-gapping.
Air-gapping puts a physical space between an organization’s online environment and its offline backup and recovery storage. Isolating data keeps it safe in the event of cyberattacks, sabotage, and accidental deletion.
The 0 in the 3-2-1-1-0 is a verification step, actively ensuring that the backups are error free.
To ensure that recovery is successful, it is essential that the backup copies contain no errors so that the backup restores completely without any issues.
Even something as simple as a USB stick can be considered offline storage if requirements are very small scale. But for most organizations, tape is an effective and proven technology providing a comprehensive, affordable solution. Backup data can be saved onto tape cartridges, stored in a secure internal tape library, or collected and held offsite by an external vault service. Either way, this maintains the requisite air gap between tapes and any network or Internet connection.
If faster recovery is required, saving data directly to hard disk drives (HDD) using object storage management might be more appropriate. However, this method does require a network connection to ingest data before isolation. Therefore, additional safeguards are needed during the transfer process to ensure protection and integrity.
Tape in the digital age
In today’s digital age, tape remains as relevant as ever. The growth of AI-powered storage designed to accommodate the escalating volumes of unstructured data will be equally as vulnerable to cyberattacks as structured information and bad actors will refine their techniques and ransomware accordingly. So, offline storage – such as tape – will be needed when putting in place solutions to create a physical distance from an organization’s live environment.
Offline storage also provides other business continuity advantages. It helps organizations maintain business operations if any type of natural or accidental disaster strikes, causing total network failure. Having secure, complete copies of data held offline enables fast resumption of day-to-day activities, minimising losses and disruption to customers, clients, or patients.
Additionally, data that is consolidated and stored in a single physical location is easier to monitor compared to when scattered across servers, networks, and service providers. Updates and deletions can be carefully controlled, ensuring consistent and reliable recovery. Whereas, restoring data from the cloud and multiple backups can be complex, fragmented, and may be incomplete.
If data sovereignty for compliance is a priority, then offline storage at a specific geographic location has an advantage over cloud when data centres are situated in different jurisdictions. In this instance tape backup has the extra benefit of being immutable, meaning data cannot be altered or overwritten. It also has a proven track record of longevity, with archived tapes capable of storing data for decades.
In an increasingly interconnected online world, offline tape backup still has an important role to play in safeguarding critical data. It may not receive the same hype as AI-powered technology and the like, but it is very much alive – and thriving.
The author
Carlos Sandoval Castro, IBM Worldwide Tape Offering Manager, the LTO Program
