A false sense of security

Mandi Pietersen, Dariel

---

Backups are, theoretically, designed to be the one clean thing left standing in a compromised estate. Experts no longer describe them as simple storage tasks but, rather, as a critical part of an organisation’s resilience strategy, determining how quickly, and safely, it can return to business after a cyber incident. But according to Kaspersky’s Compromise Assessment, as many as 40% of the web shells its analysts found were sitting in backups, undetected, ready to be reinstated the moment systems came back online. 

“A backup strategy is only useful if it protects the right systems, can survive the same incident that affects production and can be restored within a timeframe the business can tolerate,” says Mandi Pietersen, senior cloud and systems administrator at Dariel, a software engineering and IT services firm. “The important lesson is that backup success is not measured by whether a job completed successfully, but by whether the business can recover the systems it needs.”

Untested backups can offer a false sense of security. A completed backup job proves very little on its own. Pieterson says a restore test should not only check whether a server starts, it should also confirm that the application works, services start correctly, dependencies are functioning, databases connect, authentication works, network settings are correct and users can access the system as normal. Tests should be run in a sandbox realistic enough to be meaningful, and should be run quarterly for critical systems and once or twice a year for everything else. 

The outcome should also be documented, rather than left to memory. The point isn’t to tick off “restore successful”, but to understand how long key services are actually down, which staff were affected, and whether the current backup strategy supports the recovery time the business expects, says Pieterson. Richard Ford, Group CTO, Integrity360, says backups should be part of any business continuity plan. “Not only to test your backups, but to test that you can operate in instances where you have had a catastrophic incident.”

If you don’t have immutable
backups as part of your strategy,
particularly for critical data,
you are ultimately at risk. I can’t
overstate that fact.

Richard Ford, Integrity360

Standards such as ISO 27001 already say that recovery should be tested. “You’re only going to know whether that’s going to function if you are testing it on a regular enough basis,” he says, adding there’s another gap that businesses routinely miss – knowing how far back a clean copy reaches. 

Ransomware criminals often hide in an environment for weeks before triggering anything, which means the latest backup may also carry the infection. “You need to be able to understand exactly at what point systems were compromised, so that you know where it’s safe to roll back to,” says Ford. In his experience, maintaining multiple restore points, rather than a single “latest” backup, provides incident responders with enough history and evidence to identify a clean point in time and avoid restoring a system that is already compromised.

Many organisations are now adding an immutable or air gapped copy to protect against ransomware, along with zero backup verification errors, to ensure backups are regularly tested and can be restored successfully when required. If a business doesn’t have immutable backups, particularly for critical data, they’re ultimately at risk, says Ford. “I can’t overstate that fact.” But immutable storage, the kind written once and impossible to alter or delete, is only the start. 

His approach includes layers of dedicated accounts, separate subscriptions, locked‑down identities and multi‑factor authentication to put as many hurdles as possible between an attacker and the recovery copy. “You want to make it as hard as possible for anyone to get near those backups,” he says. If a backup can be edited by an administrator using a compromised account, for example, it can be erased by whoever controls that account. Air‑gapped backups keep at least one copy completely off the network. “At least one clean backup copy must remain protected even if production systems, administrator accounts, or the main backup location are compromised,” says Dariel’s Pieterson.

Richard Ford, Integrity360

---

None of this holds up if a business tries to save everything. Recovering a sprawl of irrelevant data only slows the restore when speed matters most. “Many businesses make the mistake of trying to recover everything at once,” says Pieterson, adding that organisations should, instead, identify the minimum systems needed to keep operating, understand the dependencies between them and restore them in order of priority. A business impact analysis can help define those priorities and will establish a recovery time objective (RTO) that reflects how quickly critical systems need to be back online. But an RTO can only be meaningful if it has been validated through successful recovery testing. Under the PoPI Act and GDPR, organisations are expected to keep personal data only for as long as necessary. Ford believes the same principle should apply to backups.

But when data is kept for too long, it becomes toxic. The backups that have outlived their usefulness are expensive to store, hard to govern and attractive to attackers. “Harvest now, litigate later, because the data they’re going for isn’t something that changes like usernames or passwords. It’s information that is not only sensitive, but will not change over time,” says Ford. This long-lived data, such as financial records, personal information and medical histories, is what turns encrypted backups into a future liability.

“With quantum, you can be a day early, but you can’t be a day late,” he says. That changes the role of backups. They’re no longer insurance against hardware failure or ransomware, but part of a much longer security narrative. The data they contain may need to be protected long after the systems they were created to recover have been retired.

DO THESE THINGS NOW

The gap between a backup and a recovery usually comes down to process rather than technology. “The one thing most businesses get wrong is assuming that having a backup automatically means they can recover,” says Mandi Pietersen, senior cloud and systems administrator at Dariel. “It requires discipline, ownership and a scheduled process.”