The organisation is responsible for ensuring data safety, not the cloud provider

By David Lenz, VP, Asia Pacific, Arcserve

2023 could be the year we see the first major software-as-a-service (SaaS) outage. The message will become apparent very quickly that data backup and recovery must be front and centre. 

Companies across Asia Pacific (APAC) are increasingly consuming software as a service rather than running their own IT infrastructure on premises. However, many still mistakenly believe that data protection is the responsibility of their cloud provider and assume that the provider will handle all aspects of data protection, including backing up and recovering the data.

If a service like Microsoft 365 suffers a major outage, organisations need to know that while their service is guaranteed, the organisation’s data safety is not. The responsibility lies solely on the organisation.

While cloud providers do take steps to protect their customers' data, it is ultimately the customer's responsibility to ensure that their data is backed up, secure, and recoverable. The cloud provider cannot control all factors that could lead to data loss, such as user error, hardware failure, natural disaster, or malicious attack.

Data is the lifeblood of the enterprise today and losing it can result in loss of customers, brand reputation, revenue, and, ultimately, the enterprise itself. According to Gartner, over 70% of companies will ultimately experience business disruption due to data loss from SaaS applications.

Too many IT decision-makers still rely on their SaaS vendors for data protection. Organisations need to address this disconnect. Businesses must understand that their data is their responsibility and implement proper security measures to protect their data in the cloud. Here are three strategies for organisations to ensure the security of data, even if disaster strikes their cloud provider.

Do your due diligence

Ask your cloud provider several vital questions to ensure it can deliver security and continuity for your business. For starters, what measures does the provider have in place for business continuity and disaster recovery? What are the service-level standards for uptime? For example, is the service designed to be operational 99% or 99.999% of the time?

The difference can significantly impact the business; 99.999% equates to minimal downtime, whereas 99% equates to several days of disruption per year.

It's also important to ask whether the provider offers data backup services. If so, are they included in the subscription, or do you need to secure additional coverage through a third-party partner? Also, how straightforward is it to switch to a different cloud provider if necessary? Considering this is essential, as moving between providers can sometimes be a significant hassle.

Have a backup plan

The 2021 fire at OVHcloud's data centre in France highlighted the potential risks to data in the cloud. The incident affected many websites, including government agencies, e-commerce businesses, and banks, and resulted in permanent data loss for some.

A good backup and recovery plan is essential to protect your data in the event of a disaster, whether natural or manmade. Part of the plan should involve simulating a business disruption to test and assess the organisation’s ability to recover. It's also important to regularly test your backup images to identify and fix any potential issues before they occur. In a disaster, it is critical to ensure that the backed-up data is available and can be quickly restored.

The OVHcloud fire is an example of the importance of having a recovery plan. Those customers with a plan in place at the time of the fire were more likely to minimise damage and avoid permanent data loss.

Demand immutability

When evaluating cloud providers, it is critical to make sure that the provider chosen offers immutable storage. Immutability is a type of data storage in which, once data is written, it cannot be modified or deleted. Any changes to the data must be made by writing new data rather than by altering or deleting existing data. Immutable storage protects data integrity and ensures that data remains unchanged over time.

In the case of a ransomware attack, for example, attackers may attempt to encrypt or delete data to disrupt a system's operation or demand a ransom for the decryption of the data. The attackers cannot alter or delete the data if the organisation uses immutable storage. The company can use it to recover from the attack even if the attackers successfully encrypt or delete other data.

Source: Arcserve. Lenz.

Similarly, in the case of a system outage, immutable storage can be helpful because it enables organisations to access a copy of their data. It can be essential in cases where the outage occurs due to a hardware or software failure, as it may be difficult or impossible to access the data stored on the affected system.

Without immutability, organisations are left vulnerable to data loss or corruption from external threats or system failures.

The abundance of vital documents, records, and communications now stored in the cloud means that data loss is not an option. Organisations must back up all mission-critical data and ensure it is fully recoverable. However, it is also essential to understand that your cloud provider is not responsible for safeguarding your data.

In the realm of data protection in the cloud, it is wise to hope for the best and prepare for the worst. A solid plan will ensure that you're ready for any eventuality.