Almost every business has backups. Far fewer know, with evidence, that they can get their data back quickly after a ransomware attack, a failed server, a deleted folder or a flood.
That difference matters most on the worst day. Ransomware groups routinely hunt for backups and delete or encrypt them before launching an attack, which is why federal guidance calls for backups that are offline and regularly tested. A backup that was never tested, or that sat on the same network the attacker controlled, may not be there when you need it.
Here's how to tell whether your backups would actually bring your business back.
Backup is not the same as recovery
A backup is a copy of your data. Recovery is getting your business running again: the right data, on working systems, fast enough that customers and employees can get back to work. Two numbers define whether a backup plan is good enough:
- Recovery time objective (RTO). How long you can afford to be down. For some businesses, that's a few hours; for others, a couple of days.
- Recovery point objective (RPO). How much recent work you can afford to lose. A nightly backup means you could lose up to a day of work.
If nobody has decided these numbers with leadership, the backup system was probably set up to whatever was convenient, not to what the business needs.
Common backup gaps
- Backups on the same network. If an attacker can reach the backup server or storage with stolen admin credentials, they can wipe it.
- No restore testing. Jobs report "success" for months, but nobody has tried to restore a full system, and some data turns out to be missing or corrupt.
- Missing systems. A new server, a line-of-business application or a cloud service was never added to the backup plan.
- Assuming the cloud is backed up. Microsoft 365 keeps your data available, but its recycle bins are not a long-term backup. Deleted SharePoint and OneDrive items, for example, are kept for 93 days and then permanently deleted. Files encrypted or overwritten by ransomware can also sync to the cloud. Protecting cloud data from deletion, ransomware and mistakes is largely your responsibility.
- Nobody watching. Backup failures and warnings go to an inbox no one reads.
Simple steps to make backups recoverable
- Follow the 3-2-1 rule. Keep at least three copies of important data, on two different types of storage, with one copy offsite. Today, make sure at least one copy is also offline or immutable (it can't be changed or deleted for a set period).
- Protect backups from attackers. Use separate credentials for backup systems, protected with multi-factor authentication, and don't join backup servers to your everyday network accounts. CISA recommends offline, encrypted backups of critical data.
- Back up your cloud data too. Add Microsoft 365 email, OneDrive, SharePoint and Teams, plus any cloud applications that hold critical data, to your backup plan.
- Test restores on a schedule. Restore individual files monthly and a full critical system at least a few times a year. Time how long it takes and compare it with your recovery time objective.
- Monitor every job. Someone should review backup status daily and fix failures the same day.
- Document the recovery plan. Write down what gets restored first, where it is restored to, who does it and how long each step takes. Keep a copy somewhere you can reach if your network is down.
- Review the plan when the business changes. New systems, new locations and new applications should trigger a backup review.
Questions to ask your IT team or provider
- When did we last restore a full system, and how long did it take?
- Which copy of our backups can an attacker with our admin password not delete?
- Are Microsoft 365 email, OneDrive, SharePoint and Teams backed up separately?
- What are our recovery time and recovery point objectives, and do our backups meet them?
- Who is alerted when a backup fails, and how fast is it fixed?
Where to start
This month, restore one important file and one full system from backup, and time it. Then confirm you have at least one copy of your data that is offline or immutable. Those two checks tell you more about your real risk than any backup report.
Our business continuity and disaster recovery service covers backup design, monitoring and restore testing, and our Microsoft 365 managed services include protection for cloud data. If you would like to know how quickly your business could recover today, talk with our team.
Sources
- #StopRansomware Guide, CISA
- #StopRansomware: Akira Ransomware, CISA, FBI and partners
- Ransomware, FBI
- Learn about retention for SharePoint and OneDrive, Microsoft