Backup Security

Backup security refers to the processes and technologies used to create copies of data to protect against data loss or system failure. 

Having a proper backup solution is a critical component of an organization's cybersecurity strategy. Backups provide a way to recover from ransomware attacks, hardware failures, accidental deletions, and other scenarios that could lead to lost or inaccessible data. Implementing robust backup security ensures business continuity and resilience in the face of cyber threats.

Key Concepts

Definition

Backup security involves creating duplicate copies of data and storing them in a different location from the original data. These backup copies can then be used to restore the original data if it is lost, corrupted, or made inaccessible. The duplicate data is stored on external storage media such as external hard drives, tape drives, CDs, or cloud-based backup services. Regularly scheduled backup jobs create point-in-time snapshots of the data at certain intervals which can be restored if needed.

Purpose

The main purpose of backup security is disaster recovery and business continuity. Backups give organizations the ability to recover critical systems, datasets, and application data in the event of unexpected outages. Restoring from backup effectively rolls back the clock to undo any data corruption or loss.

Backups also enable recovery from malicious attacks like ransomware. If original files are encrypted by malware, unencrypted backups can be used to restore data without paying the ransom.

Relevance

Backup is considered one of the core tenets of cybersecurity alongside concepts like encryption, access management, and network security. All organizations handling sensitive data should have clearly defined backup policies and tested recovery plans.

Regulations like GLBA, HIPAA, and PCI DSS explicitly require the implementation of secure backup procedures. Adherence to backup security best practices demonstrates due diligence.

Also Known As

• Data backup
• Backup and recovery
• Disaster recovery

Components/Types

There are several components that comprise a complete backup security solution:

Backup Software

Specialized software that coordinates the backup jobs, scheduling, and interfaces with backup storage. Some examples include Veeam, CommVault, and Veritas NetBackup.

Backup Targets

The devices or locations where backup data is stored. This includes external disks, tape drives, separate storage servers, and cloud backup services.

Backup Schedules

The predefined schedule for running backups, like daily or weekly. More frequent backups minimize potential data loss.

Retention Policies

Rules governing how long backup data is retained before being deleted or overwritten. For example, keeping daily backups for a month and weekly backups for a year.

Backup Agents

Software modules installed on systems being backed up to facilitate finding, reading, and transferring the data.

Types of Backups

Full Backups

A full backup copies all specified data. Provides maximum recoverability but consumes more storage.

Incremental Backups

Only backs up data changed since the last backup. Minimizes storage but requires more backups to fully restore data.

Differential Backups

Copies data changed since the last full backup. Provides a balance of storage efficiency and recoverability.

Synthetic Full Backups

A specialized type of incremental backup that consolidates data to functionally recover the equivalent of a full backup.

Image Backups

Makes an exact sector-level copy of an entire volume or disk, including operating systems and installed programs.

Application-Aware Backups

Backups that leverage custom agents to back up application data and settings for platforms like Microsoft Exchange or Oracle.

Importance in Cybersecurity

Security Risks

• Data breaches could lead to loss of sensitive customer information.
• Ransomware and malware attacks can encrypt or delete files.
• Natural disasters like fires, floods, and earthquakes can cause catastrophic system failures.
• Hardware failures like storage device crashes or server faults cause data unavailability.
• Accidental deletions or corruption by users leads to loss of critical business data.

Mitigation Strategies

• Maintain regularly scheduled backups to external media to create isolatable data copies.
• Use proven backup security software solutions instead of ad-hoc scripts.
• Store backup data offline or offsite to prevent the same event from destroying originals and backups.
• Perform test restores to validate the reliability of backups.
• Implement data encryption, access controls, and physical security to protect backed up data.

Best Practices

• Follow the 3-2-1 rule - 3 copies of data, 2 different media types, 1 copy offsite
• Perform full backups weekly, incrementals daily for optimal recovery granularity
• Validate integrity of backups periodically through restoration tests
• Store backups disconnected, offline, or in cloud services for geographic redundancy
• Define formal data retention policies based on compliance requirements
• Encrypt backup data to maintain confidentiality of sensitive information
• Use immutable or append-only storage for backups to prevent data tampering

Related Terms

• Continuous data protection (CDP) - Backups captured at shorter intervals approaching real-time frequency
• Business continuity planning (BCP) - Strategies focused on maintaining essential functions during outages
• Disaster recovery planning (DRP) - Processes for restoring infrastructure and systems after disaster
• High availability (HA) - Systems engineered for maximum uptime and redundancy

Backup Security Models

There are several predominant models for architecting backup environments:

Local Backups

In smaller environments, backups may be stored locally on external drives attached to the same system being protected. This provides basic recoverability in case of system failures.

Network Storage

Dedicated backup servers and devices can be deployed on premises to receive backups over the network from multiple systems. Allows centralized management and scalability.

Cloud Backups

Backups are replicated to managed cloud storage environments operated by third parties like Amazon, Microsoft or Google. Enables geographic redundancy and leverage cloud scale.

Hybrid Backups

Combination of local, network and cloud storage used together to balance control, flexibility and cost. Critical data backed up on-premises and offline while remaining data sent to cloud.

Backup Security Controls

Backup environments should implement controls to ensure confidentiality, integrity and availability of backup data:

Encryption

Backup data should be encrypted both in transit and at rest to prevent unauthorized access if media is lost or stolen.

Access Management

Strict least-privilege access controls should be enforced on backup resources to prevent unauthorized modification, deletion or theft.

Physical Security

Limit physical access to backup servers, media and facilities to protect against theft or tampering. Destroy old media before disposal.

Offline Storage

Isolate full backups offline or offsite to guarantee recoverability from malicious attacks.

Testing

Validate backup integrity through periodic end-to-end testing of the restoration process for key systems.

Backup Monitoring

Actively monitor backup jobs for success/failure and implement alerting for backup failures or delays.

Backup Security Solutions

Here are some leading commercial and open source backup tools:

• Veeam Backup and Replication
• CommVault Complete Backup and Recovery
• Veritas NetBackup
• Acronis Cyber Backup
• Cohesity DataProtect
• Bacula (open source)
• Amanda (open source)
• Rsync (open source)

And leading cloud backup providers:

• Amazon S3 Glacier
• Microsoft Azure Backup
• Google Cloud Storage
• Backblaze B2
• Wasabi Hot Cloud Storage

Further Reading

• Backup Security Best Practices - CISA
• NIST Guide to Storage Security - SP 800-88 Rev 1
• Data Backup Options - GNU Privacy Handbook

Conclusion

Robust backup security is a fundamental Data protection safeguard that enables restoration of data and business functionality when adverse events occur. Organizations should implement secure backups suited to their risk profile, with redundancy across multiple media types, including offline and cloud storage. Following best practices for backup testing, monitoring and recovery drills is key to effectively prepare for cyber incidents and ensure overall business resilience.