Avoid being held captive by ransomware with secure, reliable backups

It’s an understatement to say ransomware attacks are on the rise. In the first half of 2021, incidents increased 93%, with demands from bad actors up an astounding 518%. The attacks have frozen access to computers, leading to problems that range from gasoline shortages, hospitals unable to serve patients, closed schools and more.

City and county governments have proven to be particularly ripe targets. Atlanta, New Orleans, Baltimore, Pensacola, Fla., and Delaware County, Pa., have all fallen victim to ransomware in the last few years. While Delaware County paid a $500,000 ransom, others did not, and it cost them dearly to return to normalcy. Atlanta paid $17 million to recover, Baltimore $18 million, New Orleans spent an entire year and $5 million to get up and running again.

To pay or not to pay is not an easy choice. Case in point is the infamous Colonial Pipeline attack in which the company surprised many by forking over a $4.4 million ransom. It’s a good example, because this organization almost certainly had far more IT resources than a typical city or county government, and yet it chose to pay the ransom. Most in IT and top decision-makers watching from the sidelines expected such a large organization would have backups in place for a speedy recovery. However, according to reports, the CEO paid up because executives didn’t know the extent of the damage the attack had on their systems or how much time would be needed to get control of its pipeline back.

This raises questions for IT managers in the public sector who must ensure services are up and running. First, if Colonial did have backups in place, why pay the ransom? The backups may have been infected with the malware but considering the widespread acceptance of the 3-2-1 rule for backups that seems unlikely. Could a connection to the production network have created a path to the company’s backups? Possibly, but offsite backups are typically stored in a read-only format that malware can’t encrypt or overwrite.

More than likely the main issue was recovery time, a detail far too many don’t consider. Public sector IT must keep recovery top of mind as attacks continue to grow in volume and sophistication.

It’s about time

While we don’t have insight into Colonial’s recovery time objectives (RTOs), we certainly know it’s a large operation.  They could have been looking at several weeks or even months before they would have been able to get back in business. For those in city and county government, such issues are magnified when they’re under the watchful gaze of regulators and constituents concerned with critical services.

If IT teams hope to beat ransom demands, they must understand that brushing off an attack is all about time – and that requires a focus on recovery. It requires thorough planning. A good first step is to evaluate data and apps by their immediate priority. With that information, agencies can restore mission-critical apps and data first. After all, data of lesser importance doesn’t require a RTO of minutes. Rapid recovery is more expensive than slower recovery.

Keep in mind, different workloads require tools and technology that will match an agency’s downtime tolerance. The following are options to consider based on varied but specific recovery needs.

• Continuous protection: Vendors and backup-as-a-service providers have solutions that can deliver RTOs in minutes, but the cost is higher than typical backup approaches.
• Traditional backup to disk or other media: If an application processes information weekly, like batching backups, then being down for hours or days may not have much of an impact. There are a range of solutions that can be used in this scenario, featuring varied RTOs and pricing that can be significantly lower. Agencies must be sure to test the system to make sure it meets their needs for specific workloads.
• Tape: It’s cheap but even small amounts of tape data can take hours to restore. When stored offsite, as tape usually is, agencies could be looking at days before data is restored. Still, tape is suitable for archiving data, especially for compliance and legal purposes, the latter sometimes requiring storage for decades.

Practice makes perfect

Once a backup tiering plan is in place, it’s critical to rehearse. Applications don’t run solo — they depend on other services to work, and if workloads are not restored in the proper order, nothing will run right. Plan, practice the plan — even if just on a tabletop simulation — and review it every quarter. After all, networks are constantly changing. Following an outdated plan could end up prolonging the disaster.

With government resources stretched and IT talent hard to find, handling backup services could prove costlier than working with a managed service provider. MSPs are versed in disaster recovery and can create the right approach, factoring in both protection for each workload and cost. They can provide safeguards from a balanced, cost-efficient perspective. What’s more, they stay abreast of threat developments and work closely with vendors in the space to ensure agencies can harness the latest innovations and techniques.

Agencies can’t let ransomware hold them captive. Partnering with an MSP may be the fastest and safest route to secure, reliable backups.