Ransomware attacks may be tough to stop, but here’s how to recover

Ransomware’s eye-popping proliferation in recent years presents organizations with one of their most formidable cyberthreats yet. This is evidenced all too routinely by high-profile attacks on critical infrastructure components such as state and local governments, the energy sector, hospitals and others. 

Because ransomware is highly adaptable and pernicious in the hands of attackers, enterprises may not always be able to prevent a cyberbreach. This vulnerability means public sector agencies and private sector companies alike must deploy proactive data protection plans that touch on multiple levels of a given organization and are adaptable to constantly changing operational conditions.  

With a forward-thinking data protection plan in hand, this multitiered data strategy can help agencies and businesses recover faster when a cyberattack does occur. 

According to the Veeam Data Protections Trend Report 2022, 88% of respondents plan to increase their budgets for data protection in 2022, with the funding increase projected to be around 6%.

However an agency decides to manage its cyber risk, available resources shouldn’t be devoted to merely detecting and preventing an attack. Regardless of an agency’s size or scope, it’s always critical to consistently safeguard data, especially in the event that a breach has already occurred.  

The mandate is clear: There’s a baseline minimum of cybersecurity capabilities that organizations must adopt to make their data more recoverable and their systems more resilient in the face of a cyberattack. Here are some key steps to take in better safeguarding against ransomware threats.

Establish a broad protection platform 

Cloud services are continuing their ascent as enterprises’ premiere data platform choice for many applications, including data protection. According to the trend report, 67% of organizations are already using cloud services as part of their data protection strategy, but the overall market remains roughly balanced between respondents leveraging data centers (52%) and cloud servers (48%).

With enterprises increasingly keeping their data on a mix of IT infrastructures — ranging from cloud to on-premises and even virtualized systems — any data protection plan must account for multiple repositories. This plan must also be scalable in response to changing resources and technology needs. Whatever the repository and the requirement to scale, the ability to instantly and securely back up data is central to recovery post-attack. 

Verify data backup quality and make it immutable 

To ensure that data remains secure and usable in the event of an attack, IT professionals have to verify the data integrity of any backups at the moment they are saved. 

Some experts recommend following the “3-2-1-1-0” backup rule — a modification of the industry rule of “3-2-1,” which calls for at least three copies of important data, on at least two different types of media, with at least one of these copies being off site. The 3-2-1-1-0 backup rule can help to combat the threat of ransomware by additionally calling for IT managers to ensure that one offsite data backup be air-gapped, offline or immutable and that zero errors be present following automated backup testing and recoverability verification. 

Fend off data exfiltration 

Though immutable data backups can help safeguard against the effects of a cyberbreach, end-to-end encryption and classic cyber hygiene practices must also be deployed — and regularly exercised — to help guard against data exfiltration or alteration by an attacker.  

These hygiene practices include unique passwords for every log-in source to limit the access to data that a malicious actor may gain. Additional requisites include a strong password manager; strong, multifactor authentication; the removal of unused devices, applications and non-essential programs and utilities from all servers; a risk-based software patch management program; and ongoing end user training and awareness.  

Assure immediate and secure data recovery 

Alongside the threat of ransomware, another economic driver of data protection services is an ongoing gap between the lost value of an organization’s data in the event of an outage and how frequently that data is backed up. 

According to the data protections trend report, that gap is widening, with 89% of organizations reporting a divide between the potential losses of a data outage and the frequency with which that data is backed up, which marks a 13% increase from 2021.

Any ransomware attack has the potential to infect the entirety of an organization’s data with malware — and that malware could go beyond just the data, making it critical that any backup solution in use can guarantee that data backups can be recovered quickly and that they are free of malware. This can be done through the use of automated backup tools that can both quickly recover data and identify potential malware embedded within.  

Cyberattacks continue to be the leading reason for data outages among respondents to the Veeam survey, which concluded that 76% of organizations have had at least one ransomware event within the past 12 months and that per attack, 36% of data threatened was unrecoverable.

Ransomware attacks are serious and represent a threat to all organizations — but there are ways to institute resilience and a recovery plan in the event of such an incident. By using a layered cybersecurity strategy that integrates evolving defenses with best practices and critical tools for response and recovery, agencies can be prepared for any threat scenario.