The need for speed: minimizing downtime after a cyberattack

By Chris Rogers

Traditional approaches to backup and disaster recovery aren’t fit for purpose when it comes to recovering quickly from a cyberattack. Given the current challenging cybersecurity landscape, where ransomware attacks have become a routine daily occurrence, this should serve as a wakeup call for organizations everywhere.

In this day and age, the speed at which a business can bounce back from a cyberattack matters. Downtime disruptions can add up to a significant cost when you consider the associated loss of revenue, productivity, and reputational damage involved. To illustrate the point, when MGM Resorts experienced 10 days downtime following a ransomware attack back in September 2023, its estimated losses exceeded $100 million.

With the pace and intensity of ransomware attacks continuing to escalate, complacency is no longer an option. Especially when it currently takes organizations an average of 21 days to recover from a ransomware attack.

On-premises vaults: elevate your cyber resilience

The extended downtime experienced due to the rising tide of ransomware has prompted growing dissatisfaction with traditional data protection methods.

Conventional methods, such as lower tier backup grade storage and file-based security scanning, simply were not designed for today’s hyper-aggressive cyber threat environments. For organizations looking to protect themselves against the growing hostile threat landscape, it’s a bit like bringing a knife to a gunfight.

Let’s look at why it’s time to rethink traditional backup infrastructures and consider an alternative way to recover fast from devastating cyber events.

A big problem for traditional backup systems is their exposure to the outside world. Most vaults used by businesses today have multiple connections to external networks. In other words, they aren’t fully isolated. Worse still, some cloud vaults are always connected to the Internet. This should be a major red flag for any business looking to stay resilient against cyber threats – no matter how sophisticated your security systems are, if you’re connected to the Internet then you’re at risk.

On-premises vaults, on the other hand, solve this problem and offer some other important and significant advantages. These agentless solutions possess no controlling system for attackers to disable – in effect, they are like a house with no door. This ‘air gapping’ makes on-premises vaults impermeable in a way that cloud vaults can’t be. In other words, their walls cannot be scaled, and even if they could, nothing inside can be taken.

When it comes to cyber recovery, however, organizations will also need to go beyond data protection and consider other aspects of their recovery strategy.

Prioritize recovery speed

On-premises vaults form just one component of a wider cybersecurity strategy that ideally should be focused on reducing recovery times.

Recovery speed is of the essence during a ransomware attack, but traditional methods aren’t helpful in this respect. Lengthy backup windows, aging backup replicas, and prolonged outages all add up to sclerotic recovery time objectives (RTOs). The resulting downtime can slow operations, alienate customers and clients, and generate a cascade of problems that can prove difficult to recover from.

Instead, organizations need to focus on achieving depth of protection in addition to breadth. The aim of the game being to get back to business as usual in hours, not days.

To achieve this objective, in tandem with on-premises vaults, organizations need to implement real-time continuous data protection (CDP). This will ensure that seconds of data change are lost, rather than hours or longer. With the right pre-planning and testing protocols, this form of replication will both minimize downtime and optimize cyber recovery.

Supplementing the internal IT team: enlisting the help of MSPs, AI, and more

The days when internal IT teams could handle all things related to disaster recovery are gone. The relentlessness of today’s threat environment means organizations can no longer afford not to enlist the services of outside partners, managed service providers (MSPs), managed security service providers (MMSPs), and value-added resellers (VARs). Bottom line, during a serious crisis when every security safeguard put in place fails, your internal IT team is going to need all the help it can get.

While we’re on the subject of safeguards, many organizations are currently exploring the data protection potential of AI and machine learning. While AI is equipped to handle a multitude of crucial security tasks, in the event of a major incident it will be essential to have an experienced team of human IT professionals taking charge at the helm. The message here is that, in much the same way as it’s important to balance internal and external crisis support, it’s important not to view AI as a universal panacea.

Moving ahead with confidence

With ransomware attacks growing in volume, sophistication and complexity, organizations need to rethink how best to protect their data assets and minimize downtime. In other words, utilizing data protection solutions that will enable rapid backup and cyber recovery processes that prevent post event disruptions lasting for days or months.

For organizations that want iron-clad resilience, rethinking their traditional backup structure and investing in genuinely air-gapped CDP-based recovery solutions will deliver top tier data protection and make it easier to get up and running fast in the event of an attack.