Data is the lifeblood of modern businesses, therefore every business should have strategic data resilience plans in place to protect themselves.
So says Ewald Meyer, Senior Territory Manager at Veeam, who highlights the growing threat of ransomware and other cyber crime attacks.
“The latest Veeam Ransomware Trends Report found that most organisations are being hit by ransomware attacks more than once a year, and 94% of ransomware attacks targeted their backup repositories. Twenty-seven percent of organisations that paid ransoms were unable to recover their data after paying,” he says.
“For many organisations, losing access to their data means their doors will close. This is why we always recommend building a culture of data resilience, having an immutable copy of data to keep it safe from ransomware, and properly testing backups,” he says. “Immutable data cannot be edited, it cannot be deleted, it's encrypted and completely locked, so no one can make any changes.”
Outstanding immutability
Meyer says Veeam takes a number of unique approaches to immutability and resilience.
“We don’t believe in locking organisations into a specific hardware, appliance or platform. We are completely hardware agnostic and cloud agnostic, so customers can migrate and move their data around. If their hardware on-premises doesn't have immutability capability and they want to move something to the cloud, we can just migrate that for them with our software. It’s very important for us that they have that portability and choice,” he says.
In addition, Veeam SureBackup gives organisations the assurance that if they do get attacked, their restore is going to be successful and they will have a usable copy of their data.
Meyer explains: “If customers have Veeam Data Platform Advanced, they have access to SureBackup. It allows them to automate test backup, and test restore jobs regularly. We can spin up an isolated environment to check if everything's working, even down to the operating system and network cards. There could be an application bug or an operating system bug, a network set-up issue or some configuration issue. The tests will automatically generate a report that highlights any unsuccessful tests, so they can address the issues. This gives organisations the assurance that if they have a disaster, they have a complete, workable backup solution in place.”
Moving towards resilience
Achieving data resilience has become more complex because of multicloud hybrid strategies and rapidly increasing data volumes, Meyer says.
As a result of the changing environment, more organisations are moving data protection closer to information security, he adds. “In larger organisations, the data protection team would once have been part of the infrastructure team, with the data security team completely separate. In recent years, many organisations are combining the data protection team into the security team or at least bringing in dual responsibility or dual reporting. So the security teams have realised that data protection should be a key part of their strategy.
“We try to make things simpler for customers. We track where the threats are, and track to see if they are resilient enough. Veeam Threat Center is very helpful, with a comprehensive dashboard that can show you where there might be gaps that you could improve on,” he says.
Veeam Threat Center includes a data platform scorecard, malware detection map with a data recovery health score, service level agreement (SLA) compliance overview and recovery point objective (RPO) anomalies.
Meyer notes there are four key pillars a robust resilience strategy should be built on: "People, data security, data recovery and data freedom or portability. With these in place, you can build on things like processes,” he says.
“To help customers with these pillars, we work to ensure that they master what we call the 3, 2, 1, 1, 0 rule. This stands for three different copies of your data. One of those three would be your normal production data, and the other two would be your backup copies, and these two should be on different types of media – perhaps one on disc and one on tape or one in cloud and one on disc. One of them should be an offsite copy, and one should be completely offline, air-gapped or immutable. Zero means no errors after automated backup testing and recoverability verification,” he says.
Share