Ransomware Backup Strategies and Best Practices. How to Protect Backups from Ransomware?

Ransomware and its significance in the modern cybersecurity landscape

Ransomware attacks have been wreaking havoc on numerous organizations for more than a decade now, leading to the loss of critical and sensitive data, among other unfortunate consequences, such as huge amounts of monex being paid to criminal organizations. It is difficult to find a modern industry that hasn’t been affected by ransomware in some way or another. It is said that the number of ransomware attacks in the last quarter of 2022 was at 154.93 million, and this number keeps growing on a regular basis.

While preventive measures remain a key part of ransomware defense, maintaining regular data backups serves as the most effective means of data recovery following an attack. Data protection is paramount: because many forms of ransomware actually target the backed-up data too, necessitating measures to safeguard backups from ransomware is an absolute must.

Ransomware is a type of malware that infiltrates a victim’s computer or server(s), encrypts their data, and renders it inaccessible. The perpetrators then demand a ransom payment – typically in the form of cryptocurrency – in exchange for the decryption key. Ransomware attacks can have devastating consequences, causing significant financial losses, disrupting productivity and even causing bankruptcy.

Upon successful encryption of the targeted files, the attackers usually demand a ransom. This demand  informs the victim of the encryption and demands a ransom payment to regain access to their data. Ransom payments are often requested in bitcoins or other cryptocurrencies, making them difficult for law enforcement to trace.

If the victim fails to comply with the ransom demands, the attackers may resort to further threats, such as publishing the encrypted files online or permanently deleting them. In some instances, after a ransom payment, the attackers may even release a decryption tool but its effectiveness may be limited or may not decrypt all the affected files.

There are ways to protect your company against these attacks, and the first, critical one is to make sure you have ransomware-proof backups.

Types of ransomware

Let’s first look at the different types of threats. Encryption-related ransomware (cryptoware) is one of the more widespread types of ransomware in the current day and age. Some less common examples of ransomware types are:

• Lock screens (interruption with the ransom demand, but with no encryption),
• Mobile device ransomware (cell-phone infection),
• MBR encryption ransomware (infects a part of Microsoft’s file system that is used to boot the computer, preventing the user from accessing the OS in the first place),
• Extortionware/leakware (targets sensitive and compromising data, then demands ransom in exchange for not publishing the targeted data), and so on.

The frequency of ransomware attacks is set to increase dramatically in 2022 and beyond, and with increasing sophistication. A research from Palo Alto Networks shows that just in the first half of 2021 the average ransom payment amount is typically more than half a million dollars ($570,000+, to be exact).

While preventive measures are the preferred way to deal with ransomware, they are typically not 100% effective. For attacks that penetrate successfully, backup is the last bastion of defence that an IT department can use. Data backup and recovery are proven to be an effective and critical protection element against the threat of ransomware. However, being able to effectively recover data means maintaining a strict data backup schedule and taking various measures to prevent your backup from also being captured and encrypted by ransomware.

For an enterprise to sufficiently protect backups from ransomware, advance preparation and thought is required. Data protection technology, backup best practices and staff training are critical for mitigating the business-threatening disruption that ransomware attacks can inflict on an organization’s backup servers.

Ransomware attacks on backup systems are frequently opportunistic – not necessarily targeted. The exact process will differ depending on the program, but ransomware will typically crawl a system looking for specific filetypes and, if it counters a backup file extension, encrypt it. Then, it will try to spread and infect as many other systems as it can. The movement of these malware programs is lateral and not deliberate.

One of the best protections against such attacks is to have a data and ransomware backup solution of correct architecture, properly configured, combined with best-practice backup strategies. This includes ensuring any cloud backups are adequately protected and available, and you have a strategy to ensure you’re not syncing local infected files with those that should be kept safe in the cloud. That also means having up-to-date copies of that data available elsewhere. For any medium to large company, having an enterprise-grade backup solution is essential because correct data backup, storage and compliance practice can be the main difference between a company’s survival and failure in the event of a ransomware attack.

Common Myths About Ransomware and Backups

If you are researching how to protect backups from ransomware, you might come across wrong or out of date advice. The reality is that ransomware backup protection is a little more complex, so let’s look into some of the most popular myths surrounding the topic.

Ransomware Backup Myth 1: Ransomware doesn’t infect backups. You might think your files are safe. However, not all ransomware activates as you are infected. Some wait before they get started. This means your backups might already have a copy of the ransomware in them.

Ransomware Backup Myth 2: Encrypted backups are protected from ransomware. It doesn’t really matter if your backups are encrypted. As soon as you run a backup recovery, the infection can become executable again and activate.

Ransomware Backup Myth 3: Only Windows is affected. Many people think they can run their backups on a different operating system to eliminate the threat. Unfortunately, if the infected files are hosted on the cloud, the ransomware can cross over.

Ransomware Backup Myth 4: Paying the ransom money is easier and cheaper than investing in data recovery systems. There are two strong arguments against this. Number one – companies that pay the ransom showcase themselves to the intruders as easy targets that are not willing to fight against ransomware attacks. Number two – paying the ransom money in full is not a guaranteed way to acquire decryption keys.

Ransomware Backup Myth 5: Ransomware attacks are mostly done for the sake of revenge against large enterprises that mistreat regular people. There is a connection that could be made between companies with questionable customer policies and revenge attacks, but the vast majority of attacks are simply looking for anyone to take advantage of.

Ransomware Backup Myth 6: Ransomware does not attack smaller companies and only targets massive corporations. While bigger companies might be bigger targets due to a potentially bigger ransom that could be acquired from them, smaller companies are getting attacked by ransomware just as often as bigger ones – and even private users get a significant number of ransomware attacks on a regular basis. A recent report from Sophos shows that this particular myth is just not true, since both large-scale and small companies have a roughly the same percentage of them being affected by ransomware in a year’s time (72% for enterprises with $5 billion revenue and 58% for businesses with less than $10 million in revenue).

Of course, there are still many ways in which you can protect backups from ransomware. Below are some important strategies you should consider for your business.

Top 15 Strategies To Protect Backups from Ransomware

Here are some specific technical considerations for your enterprise IT environment, to protect your backup server against future ransomware attacks:

1. Unique, distinct credentials

This is a basic best practice for ransomware backup; and with the increasing amount of ransomware attacks on backup servers, it is as necessary as ever. The context that someone uses to access the backup storage needs to be completely confidential and only used for that one specific purpose.

To protect backups from ransomware, you should avoid working as root or Administrator. Use service accounts that are restricted as much as possible, whenever possible. By default, Bacula builds two factor authentication into the design and enables the user to apply as much separation as possible when dealing with production workloads, establishing a more ransomware-proof backup. For example, its default installation ensures that its daemons run with dedicated service accounts.

2. Offline storage

Offline storage is one of the best defenses against the propagation of ransomware encryption to the backup storage. There are a number of storage possibilities that can be used:

3. Backup Copy Jobs

A Backup Copy Job copies existing backup data to another disk system so it can be restored later or be sent to an offsite location.

Running a Backup Copy Job is an excellent way to create restore points with retention rules that are different than the regular backup job (and can be located on another storage). The backup copy job can be a valuable mechanism that can help you protect backups from ransomware because there are different restore points in use with the Backup Copy Job.

For example, if you add an extra storage device to your infrastructure (for instance a Linux server) you can define a repository for it and create Backup Copy Job to work as your ransomware backup.

4. Avoid too many file system types

Although involving different protocols can be a good way to prevent ransomware propagation, be aware that this is certainly no guarantee against ransomware backup attacks. Different types of ransomware tend to evolve and get more effective on a regular basis, and new types appear quite frequently.

Therefore, it is advisable to use an enterprise-grade approach to security: backup storage should be inaccessible as far as possible, and there should be only one service account on known machines that needs to access them. File system locations used to store backup data should be accessible only by the relevant service accounts to protect all information from ransomware attacks.

5. Use the 3-2-1-1 rule

Following the 3-2-1 rule means having three distinct copies of your data, on two different media, one of which is off-site. The power of this approach for ransomware backup is that it can address practically any failure scenario and will not require any specific technologies to be used. In the era of ransomware, Bacula recommends adding a second “1” to the rule; one where one of the media is offline. There are a number of options where you can make an offline or semi-offline copy of your data. In practice, whenever you backup to non file system targets, you’re already close to achieving this rule. So, tapes and cloud object storage targets are helpful to you. Putting tapes in a vault after they are written is a long-standing best practice.

Cloud storage targets can act as semi-offline storage from a backup perspective. The data is not on-site, and access to it requires custom protocols and secondary authentication. Some cloud providers allow objects to be set in an immutable state, which would satisfy the requirement to prevent them from being damaged by an attacker. As with any cloud implementation, a certain amount of reliability and security risk is accepted by trusting the cloud provider with critical data, but as a secondary backup source the cloud is very compelling.

6. Avoid storage snapshots

Storage snapshots are useful to recover deleted files to a point in time, but aren’t backup in the true sense. Storage snapshots tend to lack advanced retention management, reporting, and all the data is still stored on the same system and therefore may be vulnerable to any attack that affects the primary data. A snapshot is no more than a point in time copy of your data. As such, the backup can still still be vulnerable to ransomware attacks if these were programmed to lie dormant until a certain moment.

7. Bare metal recovery

Bare metal recovery is accomplished in many different ways. Many enterprises simply deploy a standard image, provision software, and then restore data and/or user preferences. In many cases, all data is already stored remotely and the system itself is largely unimportant. However, in others this is not a practical approach and the ability to completely restore a machine to a point in time is a critical function of the disaster recovery implementation that can allow you to protect backups from ransomware.

The ability to restore a ransomware-encrypted computer to a recent point in time, including any user data stored locally, may be a necessary part of a layered defense. The same approach can be applied to virtualized systems, although there are usually preferable options available at the hypervisor.

8. Backup plan testing

While it is a good idea to set up a comprehensive backup/recovery policy, you never know how it would work without testing it beforehand. Backup plan testing is a process that can help calculate recovery time, data accessibility, and many other parameters that are essential to protect backups from ransomware. This can also help figure out which parts of your system need priority in the recovery process, how fast can you restore data from offline storage, figure out if you need an entirely separate network for recovery purposes, and so on.

9. Immutable storage

Immutable storage as a term is not anything new, but it previously did not get a lot of traction due to the overall complexity when it comes to using said data. It is data that cannot be modified in any way once it is stored in a specific way. The most modern take on this concept is getting more and more popular with various cloud providers and other storage service providers with a technology called WORM, or Write-Once-Read-Many storage. This technology allows its users to lock specific objects in their data for a specific time period, making the aforementioned objects immune to any and all modifications whatsoever.

10. Backup encryption

Encryption is another way of preventing ransomware from finding or affecting the backup data in some way since encryption turns regular data into unreadable data that is impossible to decode without a proper key of sorts. The best approach is to encrypt both the data that is already stored either locally or in the cloud, as well as data that gets sent or retrieved in some way or form. The popular encryption standard for the industry these days is AES-256 for data at rest and SSL/TLS for information encrypted mid-transit.

11. Backup policies

Reviewing and updating your ransomware backup policies on a regular basis can be a surprisingly effective method of minimizing the effect of a ransomware attack or straight-up preventing it. For the backup policy to be effective in the first place – it has to be up-to-date and flexible, including solutions for all of the modern ransomware attack methods.

One of the best defenses against ransomware is a restoration of information from clean backups, since paying a ransom is not a 100% guarantee of your data being decrypted in the first place – signifying the importance of backups once again. Topics that have to be covered when performing a thorough audit of your entire internal data structure include:

• Is the 3-2-1 rule in place?
• Are there any critical systems that are not covered by regular backup operations?
• Are those backups properly isolated so that they are not affected by ransomware?
• Was there ever a practice run of a system being restored from a backup to test how it works?

12. Disaster recovery planning

A disaster recovery plan is a document that can be used as an outline of how your business would respond to a specific threat to its regular operations. The potential issues can be human errors, weather conditions, cybercrimes, hardware failures, and so on.

There are many questions that a proper DRP (disaster recovery plan) can address, including, but not exclusive to:

• What data needs to be backed up? Since covering the entirety of your system is often both extremely hard and surprisingly expensive, it is a great idea to assess your data to determine the most important parts of it. For many organizations, data such as work emails prove to be some of the most valuable resources they have. Knowing your data backup priorities helps a lot with setting up a proper backup and recovery system.
• Where is the backup going to be stored? Each and every type of storage location has its own benefits and shortcomings that have to be taken into account when planning your backup system. Of course, the best option is to use multiple storage locations for your backups, both on-premise and in the cloud, but this option can also be more expensive than others.
• What are the security measures for backups? Security controls for your backups are pretty much necessary in many different cases, especially when you’re dealing with specific data types. As an example, companies that work with PHI (protected health information) have to adhere to both HIPAA and to GDPR (if working with clients from the EU).
• How often are the backups going to be performed? Surprisingly enough, performing backups as often as possible is not always the best option since it tends to be extremely expensive in terms of storage costs. As such, it is recommended to perform an assessment of your system to figure out what is the best interval between backups for your specific business and what amount of downtime can be tolerated without completely ruining the business in question.

13. Security-centric education for employees

Backups can happen on both system-wide levels and on individual employee systems, especially when it comes to various emails and other specific info. Teaching your employees about the importance of their participation in the backup process is a great way to close even more gaps in your defense against ransomware.

At the same time, while regular employees can help with the backup process, they should not have access to backups themselves whatsoever. The more people have access to backed-up data – the higher the chances are for human error or some other way for your system and your backups to be compromised.

14. Software updates

More often than not ransomware can use vulnerabilities in your system to invade and do damage to your data in some way. Performing regular software updates is one of the best ways to combat that, even though it still needs to be used in conjunction with backup protection methods and other tactics from this list.

15. Air gapping

The strength of air-gapped backups lies in their inherent isolation. In the event of a successful ransomware attack, the disconnected backup remains unaffected, providing a clean copy of your data for recovery. You can then isolate the affected systems, eradicate the infection, and restore data from the air-gapped backup.

Air-gapped backups represent one of the most robust yet demanding forms of ransomware protection. This approach entails physically disconnecting backup storage from your premises, isolating it from cloud infrastructure, local networks, and any other form of connectivity.

In practice, air-gapped backups utilize local storage solutions such as hard drives, NAS devices, or file servers. These devices are only connected to your premises during backup operations.

Despite its effectiveness, the air-gapped backup method also presents certain limitations. For example, air-gapped backup storage may constitute an additional storage solution alongside your production storage. This necessitates defining, building, and maintaining a separate storage infrastructure.

Implementing air-gapped backups also requires careful planning and integration with your existing backup policies to avoid disruptions to business operations. At the same time, air-gapped backups are suitable for static, non-critical data that can be recovered within hours – but not for applications or databases requiring failover replication, since there is a need to connect the detached storage for each recovery operation.

Air-gapped backups offer exceptional protection against ransomware, but their suitability depends on specific requirements. Often, air-gapped backups serve as a last line of defense, safeguarding only the most critical data.

Backup System Specific Tools as a Means of Additional Ransomware Protection

Going for an augmented approach to the same problem of ransomware-infected backup, it is possible – and advisable – to use backup systems’ tools as an additional means of protecting against attack. Here are five ransomware backup best practises – to further protect a business against ransomware:

• Make sure that backups themselves are clean of ransomware and/or malware. Checking that your backup is not infected should be one of your highest priorities, since the entire usefulness backup as a ransomware protection measure is negated if your backups are compromised by ransomware. Perform regular system patching to close off vulnerabilities in the software, invest in malware detection tools and update them regularly, and try to take your media files offline as fast as possible after changing them. In some cases, you might consider a WORM approach (Write-One-Read-Many) to protect your backups from ransomware – a specific type of media that is only provided for certain tape and optical disk types, as well as a few cloud storage providers.
• Do not rely on cloud backups as the only backup storage type. While cloud storage has a number of advantages, it is not completely impervious to ransomware. While harder for an attacker to corrupt data physically, it is still possible for ransomware attackers to gain access to your data either using a shared infrastructure of the cloud storage as a whole, or by connecting said cloud storage to an infected customer’s device.
• Review and test your existing recovery and backup plans. Your backup and recovery plan should be tested on a regular basis to ensure you’re protected against threats. Finding out that your recovery plan is not working as intended only after a ransomware attack is clearly undesirable. The best ransomware backup strategy is the one that will never have to deal with malicious data breaches. Work through several different scenarios, time-check some of your restoration-related results such as time-to-recovery, and establish which parts of the system are prioritized by default. Remember, many businesses can – and should – measure in dollars-per-minute the cost of services being down.
• Clarify or update retention policies and develop backup schedules. A regular review of your ransomware backup strategies is strongly recommended. It may be that your data is not backed up often enough, or that your backup retention period is too small, making your system vulnerable to more advanced types of ransomware that can target backup copies via time delays and other means of infection.
• Thoroughly audit all of your data storage locations. To protect backups from ransomware, these should be audited to be sure that no data is lost and everything is backed up properly – possibly including end-user systems, cloud storages, applications and other system software.

How Ransomware Can Tamper With Your Backups

While it is true that backup and recovery systems are capable of protecting organizations against ransomware in most cases, these systems are not the only ones that keep progressing and evolving over the years – because ransomware also gets more and more unusual and sophisticated as the time passes.

One of the more recent problems of this whole approach with backups is that now a lot of ransomware variations have learned to target and attack not only the company’s data in the first place, but also the backups of that same company – and this is a significant problem for the entire industry. Many ransomware writers have modified their malware to track down and eliminate backups.. From this perspective, while backups still can protect your data against ransomware – you will also have to protect backups from ransomware, too.

It is possible to figure out some of the main angles that are typically used to tamper with your backups as a whole. We will highlight the main ones and explain how you can use them to protect backups from ransomware:

Ransomware damage potential increase with longer recovery cycles

While not as obvious as other possibilities, the problem of long recovery cycles is still a rather big one in the industry, and it’s mostly caused by outdated backup products that can only perform slow full backups. In these cases, recovery cycles after ransomware attack can take days, or even weeks – and it’s a massive disaster for the majority of companies, as system downtime and production halt costs can quickly overshadow initial ransomware damage estimates.

Two possible solutions here to help protect your backups from ransomware would be: a) to try and get a solution that can provide you a copy of your entire system as quickly as possible, so you don’t have to spend days or even weeks in recovery mode, and b) to try and get a solution that offers mass restore as a feature, getting multiple VMs, databases and servers up and running again very quickly.

Your insurance policy may also become your liability

As we have mentioned before, more and more ransomware variations appear that can target both your original data and your backups, or sometimes even try to infect and/or destroy your backed up data before moving to its source. So you need to make it as hard as possible for ransomware to eliminate all of your backup copies – a multi-layered defense, of sorts.

Cybercriminals are using very sophisticated attacks that target data, going straight for your backups as that’s your main insurance policy to keep your business running. You should have a single copy of the data in such a state that it can never be mounted by any external system (often referred to as an immutable backup copy), and implement various comprehensive security features, like the aforementioned WORM, as well as modern data isolation, data encryption, tamper detection and monitoring for data behaviour abnormality.

There are two measures here that we can go over in a bit more detail:

• Immutable backup copy. Immutable backup copy is one of the bigger measures against ransomware attacks – it’s a copy of your backup that cannot be altered in any way once you’ve created it. It exists solely to be your main source of data if you have been targeted by ransomware and need your information back as it was before. Immutable backups cannot be deleted, changed, overwritten, or modified in any other way – only copied to other sources. Some vendors pitch immutability as foolproof – but in terms of ransomware backup, there is no such thing. But you should not fear immutable backup ransomware attacks. Just ensure you have a holistic strategy that includes attack detection and prevention, and implement strong credential management.
• Backup encryption. It is somewhat ironic that encryption is also used as one of the measures to counter ransomware attacks – since a lot of ransomware uses encryption to demand ransom for your data. Encryption doesn’t make your backups ransomware-proof, and it won’t prevent exploits. However, in its core, backup encryption is supposed to act as one more measure against ransomware, encrypting your data within backups so that ransomware cannot read or modify it in the first place.

Visibility issues of your data become an advantage for ransomware

By its nature, ransomware is at its most dangerous when it gets into a badly managed system – “dark data”, of sorts. In there, it can do a lot of damage, a ransomware attack can encrypt your data and/or sell it on the dark web. This is a significant problem that requires the most cutting-edge technologies to detect and combat effectively.

While early detection of ransomware is possible with only a modern data management solution and a good backup system, detecting such threats in real-time requires a combination of machine learning and artificial intelligence – so that you can get alerts about suspicious ransomware activity in real-time, making attack discovery that much faster.

Data fragmentation is a massive vulnerability

Clearly, a lot of organizations deal with large amounts of data on a regular basis. However, the size is not as much of a problem as fragmentation – it’s not uncommon for one company’s data to be located in multiple different locations and using a number of different storage types. Fragmentation can also create large caches of secondary data (not always essential to business operations) that can affect your storage capabilities and make you more vulnerable.

Each of these locations and backup types are adding another potential venue for ransomware to exploit your data – making the entire company’s system even harder to protect in the first place. In this case it is a good recommendation to have a data discovery solution working within your system which brings many different benefits – one of which is better visibility for the entirety of your data, making it far easier to spot threats, unusual activity and potential vulnerabilities.

User credentials can be used multiple times for ransomware attacks

User credentials have always been one of the biggest problems in this field, providing ransomware attackers with clear access to valuable data within your company – and not all companies can even detect the theft in the first place. If your user credentials become compromised, ransomware attackers can leverage the different open ports and gain access to your devices and applications. The entire situation with user credentials became worse when, because of Covid, businesses were forced to largely switch to remote work around in 2019 – and this problem is still as present as ever.

According to Verizon’s 2021 Data Breach Investigation Report, over 60% of data breaches in a year were performed using compromised credentials. These vulnerabilities can also affect your backups and leave them more exposed to ransomware. Typically the only way to combat this kind of gap in security is to invest into strict user access controls – including features such as multi-factor authentication, role-based access controls, constant monitoring, and so on.

Always test and re-test your backups

Many companies only realize their backups have failed or are too difficult to recover only after they have fallen victim to a ransomware attack. If you want to ensure your data is protected, you should always do some kind of regular exercise and document the exact steps for creating and restoring your backups.

Because some types of ransomware can also remain dormant before encrypting your information, it’s worth testing all your backup copies regularly – as you might not know when precisely the infection took place. Remember that ransomware will only continue to find more complex ways to hide and make your backup recovery efforts more costly.

Conclusion

For maximum protection of your backup against ransomware and similar threats, Bacula Systems’ strong advice is that your organization fully complies with the data backup and recovery best practices listed above. The methods and tools outlined in this blog post are used by Bacula Systems’ customers on a regular basis to protect their backups from ransomware. For companies without advanced-level data backup solutions, Bacula Systems urges these organizations to conduct a full review of their backup strategy and evaluate a modern backup and recovery solution.

Download Bacula’s white paper on ransomware protection.