No less than 58% of Dutch companies and organizations that fell victim to ransomware in 2023 had no backup. A sound backup and disaster recovery strategy is essential for rapid recovery after a ransomware attack, and both play a crucial role in ensuring business continuity.

Backup and disaster recovery

A backup focuses on regularly copying data, files, and information—preferably to a secondary location—to enable restoration in the event of loss or corruption. If data loss occurs due to, for example, a ransomware attack, it can take days or weeks before the backup can be restored. After forensic investigation, the data can be made available for production. Disaster recovery goes a step further; it is a comprehensive plan that encompasses not only data restoration but also the ability to restore entire IT infrastructures, networks, and business processes within a significant timeframe following severe disruptions, such as natural disasters or cyberattacks. This minimizes downtime and ensures the organization can return to normal operations as quickly as possible, even if entire servers or data centers fail. Together, Backup as a Service and Disaster Recovery as a Service form a powerful solution to guarantee your business continuity, as both data recovery and operational recovery plans are secured against unexpected outages.

Recovery, and by extension business continuity, is usually expressed in two types of objectives: Recovery Time Objective (RTO) and Recovery Point Objective (RPO). RTO indicates how long your organization can function without a specific service before it leads to loss or risk. RPO determines the point in time from which your data can be restored. While traditional backup and snapshot solutions offer an RPO of 15 minutes to as much as 24 hours, requirements in modern digital environments are much stricter. Both RTO and RPO must be as short as possible here—ideally expressed in minutes or even seconds. Many organizations focus on a quick restart (RTO) but fail to consider that the inability to recover lost data (RPO) can have long-term consequences.

When developing a business continuity strategy, it is important to remember that not all systems, applications, and data are equally business-critical. Data classification is necessary for this. For the most business-critical applications, a working disaster recovery strategy is essential, featuring a low RTO and RPO (minimal data loss and rapid recovery) and a tested recovery plan. For other applications and data types, less expensive solutions and higher RPOs and RTOs may be acceptable.

The NIST Cybersecurity Framework

The NIST Cybersecurity Framework is a guideline developed by the National Institute of Standards and Technology (NIST) to help organizations improve their cybersecurity. The framework consists of five core functions: Identify, Protect, Detect, Respond, and Recover. These functions help organizations understand their security risks, implement protective measures, monitor threats, respond to incidents, and recover from attacks.

It is essential to integrate all components of the NIST model into a plan that protects your organization against the consequences of a cyberattack. Naturally, you want to prevent a cyberattack and put all your efforts into that. But it is just as important to be prepared for the moment you are actually hit. Preventive cybersecurity tools can be excellent at detecting and blocking attacks, but ransomware can still break through all layers. In that case, recovery solutions are crucial.

A report by Sophos revealed that in 57% of cases, attackers were successful in compromising backups, leaving more than half of the victims unable to complete their ransomware recovery. This demonstrates how valuable an external, immutable backup can be.

When we zoom in on the recover component, we see that it involves measures taken to restore affected services and systems to their pre-incident state. To arrive at an appropriate solution, you can ask yourself the following questions:

• What does it cost your organization per hour if essential data is unavailable?

• What are the consequences of losing this essential data, and is it even possible to fully recover it?

• How quickly can you make your essential data available for forensic investigation so that security experts can secure it again?

• Do you have a comprehensive playbook ready that outlines your organization's response in the event of a ransomware attack?

• Can you guarantee your board of directors that the organization will recover from a ransomware attack? Consider the risk that hackers may not release the environment despite payment, or that they may hack it again later because the necessary measures have not yet been implemented.

Most organizations know they need to combat ransomware with a layered, proactive, and reactive security solution—also known as defense-in-depth. But which solutions should be used, and how can they best reinforce each other? Relying solely on an external backup can mean recovery takes days, leading to downtime, data loss, and high costs. AI-driven Ransomware Recovery, by contrast, focuses on detecting incidents, responding to them, and restoring data within minutes.

Want to know more?

In next week's blog post, we will discuss the solution Fundaments offers for unparalleled ransomware protection: AI-driven Ransomware Recovery. Would you like to know what Fundaments can do for you right now? Please contact us by calling 088 4227 227 or emailing info@fundaments.nl.