Why backups, recovery and security are all part of the same story

World Backup Day falls on March 31 every year, reminding businesses about the importance of backing up their data. But the backup story is not only about backup; businesses must also be aware that they should look beyond backup per se, according to industry observers.

Source: Trend Micro. Ng.

David Ng, Country Manager for Singapore at Trend Micro said: "Data is constantly on the move. Not to mention, threat actors are hungrier for our valuable data. That is why CISOs and CIOs invest millions of dollars in tools, solutions, and processes for data backup, security, and protection."

"When disasters occur, organisations suffer. That is why they see backups, recovery, and security of data and systems as crucial for business continuity," agreed Stephen McNulty, President Asia Pacific and Japan, Micro Focus.

Raymond Tan, VP, Syniti Data Replication, Asia Pacific and Japan added: "Business operations have changed drastically in the last few years, with employees largely working in disparate locations. As organisations look to improve the resilience of their operations, focusing on data and backup strategies will be imperative for success.

Source: Syniti. Tan.

"To that end, one process that businesses can embrace is data replication, which involves creating copies of data and storing them in multiple locations. This process ensures that every team member has timely access to the same data, and all changes made are universal across systems, promoting efficiency in business processes and decision-making.

"Most importantly, though, it increases the reliability and resilience of data, making it a key capability for disaster recovery efforts. In the case of an unplanned disruption or cyberattack, there will always be a reliable copy of the data saved elsewhere. The quality of backups can ensure that businesses recover from such events with little to no downtime or data loss – which is key to building resilience."

CK Chim, Field Chief Security Officer APAC at Cybereason, also emphasised the need for business continuity. "You must have an incident response plan, a so-called 'immutable' backup, and must test, test, test - from tabletops* to live restore tests," he said.

"And a crucial element is to be aware and have strategies in place for recovery, in the event that backups contain malware, backdoors or vulnerabilities from the original critical failures. Finally, security for the processes that enable backup and restore functions and the backup environment itself have to be strong and robust too."

Ng's tips for better backup also include a security element. "Today, organisations must be able to identify, track, and secure all confidential data from multiple points within the business. This, firstly, warrants strong endpoint security with behavioural analysis capabilities for threat detection and response," he said.

"The next step is a robust backup strategy, which should encompass a range of activities – from automated tests to validate its consistency, simulations to verify the backup data, and scanning for malware prior to and when restoring from the backup. This will ensure end-to-end security and protection for business data without impacting employee productivity, thereby reinforcing resiliency in operations."

Source: Micro Focus. McNulty.

McNulty said backups are part of a bigger picture. "Backups are an essential practice to safeguard data, but they are not the most important step. While they do indeed ensure availability and integrity of data, I believe recovery strategies should take precedence," he said.

"Here’s why – it is the ability to restore data and systems to a workable state, and within a reasonable timeframe, that makes backups valuable. Without this ability, there is no point in performing the backup in the first place.

"Furthermore, backups must also be complemented with adequate security controls. To that end, business leaders should consider the Zero Trust model, which implements a collection of solutions covering a range of needs – from access control and privilege management to the monitoring and detection of threats. This will ultimately provide the best protection possible as information travels across devices, apps, and locations."

*A tabletop session refers to a discussion-based session as opposed to something that may involve more activity.