How To Protect Backups from Ransomware Attacks

Best Practices for Backup Protection from Ransomware

By implementing the following backup security best practices, companies have a better chance of minimizing the impact and recovering quickly from a ransomware attack.

1. Establish a disaster recovery plan

Disaster recovery plans are important documents that detail how a business deals with situations that can negatively impact their systems and operations. These can include weather events, human error, hardware failure, and of course, ransomware. Key considerations in a disaster recovery plan include determining what data needs to be backed up, how often backups should be performed, where the data should be stored, how it will be secured, and how frequently backups should be tested.

2. Educate employees on your disaster recovery plan

Backups can be taken on individual employee machines, your organization’s email system, and your broader infrastructure. Hence, it is important that employees are informed about your disaster recovery plan. Even if your organization has automatic cloud backups for employee information, it’s important to educate employees on the importance of backing up their data using a physical drive or a cloud-based solution.

3. Store multiple backups offsite or offline

By storing backups offline or securing them in a physically separate location, the risk of them being compromised by ransomware is significantly reduced. Whether you store data offline or use cloud-based data centers, it helps to keep data in more than one place. It’s worth noting that there are different strategies for creating copies of data, which include full, differential, and incremental backups. A full backup copies everything, a differential backup copies everything that has changed since the last full backup, and an incremental backup copies everything that has changed since the last backup of any type. Differential and incremental backups are faster than full backups when done on fixed drives, but are more difficult to perform on tape. Tape is better suited for full backups, however, using tape will require a secure storage location, such as a fireproof safe. The strategy you choose will depend on whether you are performing an onsite or offsite backup.

4. Use versioning and rollbacks

Versioning can protect backups from ransomware, but they can still be compromised if all versions are held on the same drive. To implement versioning and recover from a ransomware attack, businesses can use the 3-2-1 rule by implementing incremental backups on one store and versioning on another. Overnight batch processing ensures the most up-to-date data before employees start their workday. If a ransomware attack occurs during business hours, the system can be shut down and restored from tape. Once the system is operational, users can access most of their data, and the offsite incremental backup can be reviewed to provide updated versions of specific files. This strategy is suitable for high-turnover sites that perform incremental backups multiple times a day.

5. Establish a reasonable backup schedule

Backups should be taken as often as reasonably practicable. Your backup schedule relies on factors such as the available storage capacity, the backup systems deployed, and the volume of data generated by the organization. Small businesses with limited staff may be able to back up once a day, while larger enterprises with numerous employees may benefit from more frequent backups to ensure seamless business continuity.

6. Restrict access to backups

Limiting access to backups to a small number of individuals or a single system account is a wise move. By minimizing the number of people with access to the credentials, the chances of human error leading to password compromise are significantly reduced.

7. Test backups regularly

Just having a backup of your data is insufficient. It is essential to have the ability to restore system access using that backup. The best solution is to automate the process of system recovery by implementing the required code, so that with a single click, the latest data can be retrieved and restored automatically. If your team lacks the resources to conduct regular tests, you can consider outsourcing backups to a vendor. They can collaborate with you to ensure the safety of your backups against ransomware and enable swift recovery of essential items like mailboxes, contact lists, calendars, and personal folders in the event of an attack.

How Lepide Helps Detect and Prevent Ransomware

Lepide offers a solution that helps to protect backups from ransomware by identifying and closing security gaps within your Active Directory environment. It identifies inactive users, users with excessive permissions, and open shares that can be accessed by multiple users on a network, all of which can make backups vulnerable to ransomware attacks. Lepide also enables real-time detection of ransomware spread, which might include failed file reads, file renaming, and changes in user behavior. Additionally, the platform allows administrators to easily roll back unauthorized or unwanted changes made to Active Directory and Group Policy, and provides backup snapshots and audit reports to help with the restoration and identification of specific changes, respectively.

To see how the Lepide Data Security Platform can protect your backups from ransomware attacks, schedule a demo with one of our engineers.