Ransomware is one of the biggest cybersecurity threats facing businesses today. Ransomware is a type of malicious software that encrypts files on a computer or network. The attackers then demand a ransom payment in cryptocurrency to provide the decryption key. Failure to pay could result in permanent data loss.
Because ransomware can spread quickly and encrypt entire networks, it can be devastating for businesses. Many organizations are turning to the cloud and cloud backups as a way to defend against ransomware.
What is cloud backup?
Cloud backup, also known as online backup, involves backing up data over the internet to remote cloud servers. This differs from traditional on-premises backup which uses local storage media. With cloud backup, files are uploaded to servers operated by the backup provider.
Some key advantages of cloud backup include:
- Offsite protection – Backups are stored remotely rather than onsite where they are vulnerable to the same ransomware attack.
- Scalability – Cloud storage is highly elastic allowing large amounts of data to be backed up.
- Accessibility – Cloud backups can generally be accessed and restored from any internet-connected device.
- Managed services – Cloud backup is offered as a managed service taking the burden off in-house IT staff.
Does cloud backup protect against ransomware?
In general, yes – cloud backups can serve as an important safeguard against ransomware if properly configured. By maintaining copies of data offline and outside the reach of local malware infections, cloud backups provide recovery options in the event ransomware spreads through a network and encrypts files.
However, cloud backup alone is not a foolproof ransomware solution. The level of protection offered depends on the specifics of the cloud backup strategy:
- Backup frequency – Backups that happen more often will minimize potential data loss from ransomware encrypting local files between backups.
- Immutability settings – Many cloud backup providers offer options to make backups “immutable”. This prevents backups from being deleted or encrypted by ransomware that has gained administrator access.
- Isolation – Backups should be isolated and inaccessible directly from the local network to prevent ransomware reaching them during an attack.
- Versioning – Retaining multiple backup versions over time rather than just the latest copy enables reverting to an earlier, unencrypted backup if needed.
Defense in depth
While cloud backups provide a critical safety net, the most effective ransomware protection involves a full defense-in-depth approach. This combines cloud backup with other security layers like:
- End-to-end encryption to render data useless if stolen.
- Advanced endpoint security on all devices to prevent malware infections.
- Network segmentation to prevent lateral ransomware movement.
- User security training to recognize phishing and other social engineering.
- Strict access controls to limit account permissions.
- Endpoint detection and response to identify and isolate suspicious activity.
With a robust, multilayered security posture, the risk and potential impact of ransomware attacks can be substantially reduced.
Should cloud backup be used for disaster recovery?
While cloud backup offers protection against ransomware, it is only one part of a comprehensive disaster recovery plan. Effective disaster recovery requires being able to restore full operations quickly, not just recover individual files from backup.
Cloud backup should be combined with other disaster recovery measures such as:
- High availability – Use redundancy to minimize downtime and avoid data loss in the first place.
- Snapshot backups – Frequent incremental backups capture point-in-time restore points.
- Virtualization – Recover failed servers faster through virtualization.
- Replication – Copy data to remote sites for site resilience.
- Alternative worksite – Support critical operations restoration offsite during an outage.
By pairing cloud backup with disaster recovery orchestration, system failover capabilities and cyber incident response planning, an organization can be well prepared to handle ransomware and other threats.
Cloud backup best practices
To help ensure cloud backups provide maximum ransomware protection:
- Select a backup provider with security-centric backup architecture and immutable backup options.
- Isolate backups from the production network – don’t backup locally and then replicate. Upload directly offsite.
- Enable MFA for backup provider account access.
- Use private links not exposed on internet where possible.
- Encrypt backups end-to-end before uploading.
- Back up frequently with hourly snapshots if possible.
- Regularly test backup restores. Have multiple recovery options.
- Segment backups – don’t allow single account to access all backups.
- Mask sensitive data like passwords in backups.
The role of MSPs in cloud-based ransomware protection
Managed service providers (MSPs) are an important part of cloud backup and ransomware defense for many organizations. MSPs manage IT infrastructure and services for businesses and bring experience defending against ransomware for multiple clients. Working with an MSP can help in several ways:
- An MSP can provide 24/7 monitoring and response to rapidly detect and contain a ransomware attack minimizing business disruption.
- MSPs have visibility across their client base to identify wider ransomware campaigns early and alert others to the threat.
- MSPs are experts in cloud-based backup solutions and can properly configure platforms for optimal ransomware resiliency.
- MSPs stay current on the threat landscape and threat intelligence to adapt defenses accordingly.
- MSPs can rapidly restore operations using cloud infrastructure and backups if defenses fail.
The right MSP has the technology stack and expertise to orchestrate an end-to-end ransomware readiness and response approach.
When backups fail
While cloud backups provide the last line of protection against ransomware, they can still fail and leave an organization crippled. Some common cloud backup limitations include:
- Backups lag behind production systems allowing recent data changes to be lost.
- Backups are not fully isolated and get encrypted or deleted by ransomware.
- Too few backup versions are retained limiting restore points.
- Unencrypted backups can have sensitive data accessed during a breach.
- Testing and validation of backups is inadequate.
To address backup vulnerabilities, organizations should:
- Perform regular failover tests to validate recovery capabilities.
- Have layered backups with on-premises and hybrid cloud options.
- Invest in emerging technologies like immutable file systems.
- Keep backups logically and physically isolated from ransomware access.
- Mask sensitive data in backups that could lead to regulatory fines if exposed.
Recovering from a ransomware attack without paying ransom
Recovering from a ransomware attack without paying the criminals requires preparation:
- Have a documented incident response plan for fast, coordinated action.
- Isolate and contain infected systems rapidly to stop spread.
- Assess the strain, reach of encryption and options for recovery.
- Determine if backup restoration can recover critical systems.
- Rebuild infected systems from scratch to clear malware.
- Implement additional security measures to prevent reinfection.
While difficult and disruptive, with the right backup solution and response approach, paying the ransom can be avoided. However, data loss is still likely depending on the speed of response, backup frequency and other factors.
When should ransom be paid?
The FBI and most security experts advise never paying ransom. Rewarding criminal activity encourages further attacks. However, in rare cases when data is utterly irreplaceable and backups unavailable, organizations may consider paying ransom as an absolute last resort. Examples might include:
- Ransomware encrypting recent data with no backup copies.
- Threat actors stealing sensitive data and threatening to publish if ransom unpaid.
- A hospital with ransomware-encrypted critical medical records unavailable elsewhere.
- An organization on the brink of bankruptcy that cannot survive downtime.
If considering paying ransom, consult law enforcement and evaluate:
- The likelihood criminals will honor the deal and provide working decryption.
- The potential for destructive malware being installed during decryption.
- If payment would violate trade restrictions or cybercrime laws.
Ransom payment does not guarantee problems end – the attack may have caused other hidden damage. Weigh the decision carefully.
Reporting ransomware attacks
If impacted by ransomware, promptly report the attack to:
- Local law enforcement – they may involve state or federal cybercrime units.
- The FBI through the Internet Crime Complaint Center.
- The Federal Trade Commission if personal information was compromised.
- Industry-specific regulatory bodies such as HHS for healthcare providers.
- Information sharing organizations like the Cyber Threat Alliance.
Reporting supports law enforcement efforts to combat ransomware. It also helps spread threat intelligence to improve defenses across industries.
Final recommendations
To effectively leverage cloud backups as part of a ransomware defense strategy, businesses should:
- Implement layered backups with both local and cloud-based systems supporting recovery point objectives.
- Isolate backups from ransomware access through physical separation, access restrictions, immutability settings, and other controls.
- Validate recovery processes through regular restore testing and failover/disaster recovery exercises.
- Invest in threat protection, user education, and IT infrastructure improvements to reduce the risk of ransomware impacting operations.
- Have an incident response plan that outlines roles, responsibilities, and actions if ransomware strikes.
Cloud-based backup combined with comprehensive security and readiness best practices can help businesses survive a ransomware attack.
Conclusion
Cloud backup solutions have clear benefits in protecting against catastrophic data loss from ransomware. To realize these benefits, cloud backups must be properly configured with sufficient frequency, redundancy, encryption, isolation and versioning.
However, even the best cloud backups should only be one part of a defense-in-depth strategy. The most effective protection combines robust backups with policies and technology to prevent, detect and respond to ransomware attacks across the environment.
By leveraging cloud backup as part of a holistic approach, businesses can minimize the business disruption and financial damage inflicted by ransomware.
