Why is the Security of Backup Infrastructures Important?

The security and integrity of data, which is the most valuable asset of an institution or organization and is now hosted entirely in the digital environment, are of vital importance. To ensure the integrity and security of data, many technologies and solutions are utilized, such as smart and highly accessible storage units, endpoint protection and threat detection solutions, firewalls, business continuity centers, and backups.

Thanks to these solutions, data integrity and security can be partially ensured against problems such as system failures, human errors, and natural disasters. However, considering the frequency of ransomware attacks, which are among the most prevalent cyber threats today, and the rapid development of these attack methods, it is crucial that backup infrastructures are configured and operated in accordance with best practice methods and current cybersecurity principles.

Targeted ransomware is currently the number one threat. When malicious actors carry out targeted ransomware attacks, they specifically target and encrypt your backup data along with your primary data. If they are successful, you are left with no choice but to pay the ransom, which gives them an incentive to try again.

The key to avoiding ransom payments is to have backups that can be used to restore systems that have been encrypted by ransomware. To protect these backups from ransomware, it is crucial to create as many barriers as possible between your main systems and backup systems, thus creating layers of protection. This ensures that attackers cannot access your backup infrastructure. Even if attackers can gain access to your backup infrastructure, these layers of protection can help prevent them from damaging your backups.

How to Operate Backup Infrastructures to Mitigate the Impact of Ransomware Attacks?

One of the primary actions taken by attack groups carrying out targeted ransomware attacks is to attack the backup platforms and render the backups unusable by exploiting the backup technologies in the relevant systems, preventing the backups from being restored.

The following measures must be taken to ensure that backup infrastructures are resistant to cyber-attacks:

• The backup policy should be created in accordance with the 3-2-1 rule.

1- Primary copy/backup of data
2- Secondary copy/backup of data to a different location
3- Offline/off-location copy/spare 

• Ransomware-protected backups should be made. 
• A disaggregated network topology should be used for backup. 
• The visibility of network traffic used for backup should be increased. 
• Regular recover/restore tests should be performed. 
• Access to the backup media should be over restricted networks. 
• Access authorizations to the backup environment should be configured in accordance with the role-based and minimum authorization policy. 
• Appropriate audit, alarm and warning mechanisms should be in place for the backup software. 
• Event logs should be routed to a centralized log management (SIEM) solution. 
• Endpoint security solutions must be active on servers running backup software and components.

Backup Infrastructure Security Analysis Service

At ADEO, our Backup Infrastructure Security Analysis Service is designed to evaluate the current state of an institution or organization's backup environment from a cybersecurity perspective and provide suggestions for improvement, thereby increasing the maturity level of their backup infrastructure.

All of our content and controls for this service were developed by leveraging the field experience of ADEO's consultants and technical experts (in infrastructure, cybersecurity, and GRC) as well as industry standards such as ISMS, NIST, CIS, PCI DSS, and documents from recognized authorities.

The ADEO Backup Infrastructure Security Analysis Service consists of interviews with relevant IT managers of the institution/organization, technical examinations of relevant products, and situation assessment studies. We do not make any interventions that will have a positive or negative impact on the structure in question.

We carry out our work for the following technologies and processes:
•    Backup software and components (management server, media server, proxy server, etc.)
•    Storage products used for backup (appliance, storage, tape, cloud)
•    Network topology used for backup (LAN, WAN and SAN)
•    Identity and access management of accounts (operations, management and service) used for backup
•    Backup and recovery policies
•    Backup data destruction procedures
•    Monitoring and event logging processes for backup software and hardware