Ransomware: All the ways you can protect storage and backup

Ransomware is a big threat to organisations of all sizes. According to one piece of research, around two-thirds of disaster recovery incidents are a result of ransomware. Meanwhile, firms take an average of 21 days to recover to normal operations.

The growth of ransomware has put data storage and backup on the frontline of cyber defences, and as firms have bolstered their anti-ransomware measures, attackers have become more sophisticated and dangerous.

Attackers have moved from encrypting production data to targeting backups and backup systems. Their goal is to make it harder for organisations to recover, and so more likely they will pay a ransom. Also, double- and triple-extortion attacks – where criminal groups threaten to expose sensitive data, or even use it to target individuals – have raised the stakes still further.

In response, chief information security officers (CISOs) and chief information officers (CIOs) have looked to harden systems against ransomware attack, with use of immutable snapshots, air-gapped backups and artificial intelligence (AI)-based threat detection. Suppliers have also bolstered anti-ransomware tools. Some are even offering ransomware recovery guarantees that offer financial compensation if an attack does happen.

Ransomware attacks work by spreading malware that disables access to data. The malware usually enters the organisation through phishing, infected documents, or compromised or malicious websites. It acts to encrypt data, then attackers demand a ransom for the decryption key.

The first line of defence is to detect and block phishing attacks, through antivirus and malware detection on client devices and on the network, and through user awareness and training.

Much of this is standard cyber hygiene. Most methods that work against malware and phishing will work equally against ransomware. Security researchers point out that the malware component of ransomware attacks is often not very sophisticated.

However, although cyber hygiene measures will reduce risks, they are not fool-proof. Therefore, firms also look at deeper levels of data protection against encryption, as well as detecting and blocking suspicious activity on the network.

Good backups remain an important defence against ransomware. If a firm can recover its data from a clean backup, they have a good chance of returning to normal operations without the need to pay a ransom. And, as security advisors such as the UK’s NCSC point out, paying the ransom is no guarantee of being able to recover data.

Off-site backup, or data that is “air gapped” and separated either physically or logically from production systems, provide a good level of protection, but recovery from off-site backups can be slow.

A clean recovery also requires users to spot an attack early enough to prevent backups being infected by malware. Also, attackers now actively target backup systems, with a view to disabling them or corrupting backup files.

This has led storage suppliers to build additional levels of ransomware protection into storage and backup technologies to provide additional layers of defence.