Forget fires and floods – why disaster recovery should focus on ransomware

Ran­somware has been front page news in 2021. In a world of esca­lat­ing cyber­at­tacks, ran­somware gar­nered atten­tion with a series of attacks that tar­get­ed every type of organ­i­sa­tion from util­i­ty providers to food sup­pli­ers to health­care and local author­i­ties. These ser­vices can strug­gle to recov­er months after an attack.

Such is the threat, the head of the Nation­al Cyber Secu­ri­ty Cen­tre (NCSC) described ran­somware as “the biggest online threat to peo­ple in UK.”

The prob­lem is that some busi­ness deci­sion mak­ers still don’t see ran­somware in the same con­text as oth­er dis­as­ters, like fires or flood­ing. Cyber­crime is the only indus­try where the scale of inno­va­tion hap­pens on the crim­i­nal side. The more they achieve ‘suc­cess’ the more we will see a rise in vol­ume and sever­i­ty, argues Andy Fer­nan­dez, senior man­ag­er, prod­uct mar­ket­ing at Zer­to, a leader in dis­as­ter recov­ery, back­up and cloud mobil­i­ty.

“At some point every organ­i­sa­tion will be faced with a ran­somware attack and will need to recov­er,” he says. “If I was an organ­i­sa­tion, my big­ger con­cern is not ‘will a nat­ur­al dis­as­ter or out­age hap­pen?’ It’s ‘I know I’m going to get hit by ran­somware. How am I going to respond to that?’”

Weeks of downtime post-attack

Many organ­i­sa­tions with a dis­as­ter recov­ery and busi­ness con­ti­nu­ity plan in place will be con­fi­dent in their abil­i­ty to recov­er fol­low­ing an attack. But one crit­i­cal ques­tion remains: how long will it take them to recov­er their data, and how much dam­age will be done in the mean­time?

“Often com­pa­nies will be using lega­cy data pro­tec­tion,” says Fer­nan­dez. “It’s not just about: can I recov­er? It’s about how quick­ly I can recov­er. By the time those organ­i­sa­tions are able to recov­er their data – to become oper­a­tional again – the busi­ness has suf­fered mas­sive dis­rup­tion. It can take days, even weeks, to recov­er data in those instances. We’ve seen organ­i­sa­tions pay the ran­som, even when they have back­ups avail­able because they can­not afford to spend the time recov­er­ing from back­ups.

Impor­tant­ly, data loss and down­time are sep­a­rate things.

“There are two impor­tant met­rics,” says Fer­nan­dez. “The first is the recov­ery point objec­tive (RPO), which refers to the poten­tial data loss the organ­i­sa­tion faces in the after­math of an attack. When was the data last copied? Six hours ago, 12 hours, one day? The sec­ond is the recov­ery time objec­tive (RTO), which is how short is the time­line from the point of encryp­tion to the point of recov­ery?”

Continuous data protection

One answer is con­tin­u­ous data pro­tec­tion (CDP). CDP can reduce ser­vice lev­els — both RPO and RTO — from hours to min­utes, even sec­onds. In fact, CDP recov­er­ies can assist organ­i­sa­tions in recov­er­ing to a state sec­onds before an attack, in just min­utes.

While tra­di­tion­al meth­ods of data pro­tec­tion take timed ‘snap­shots’ as a way of back­ing up data, CDP solu­tions like Zer­to con­tin­u­ous­ly repli­cate that data. This can be to mul­ti­ple sites, with no snap­shots or per­for­mance impact with data being repli­cat­ed every five sec­onds. This means cus­tomers can quick­ly restore entire sites and appli­ca­tions in min­utes, at scale.

“It’s about find­ing solu­tions that can get you back up and run­ning with­out pay­ing the ran­som,” says Fer­nan­dez.

‘When,’ not ‘if’

Research sug­gests it is a case of ‘when,’ not ‘if’ an organ­i­sa­tion falls vic­tim to a cyber­at­tack. One IDC sur­vey shows 95% of mid-sized and enter­prise organ­i­sa­tions have suf­fered a mali­cious attack – and more than a third have suf­fered more than 25 attacks.

Eight out of 10 of those attacks result­ed in data cor­rup­tion, with 43% of organ­i­sa­tions expe­ri­enc­ing unre­cov­er­able data with­in the past 12 months.

“Whether you’re the CEO or CIO, ran­somware is not your IT manager’s prob­lem. It’s your prob­lem,” says Fer­nan­dez. “Because it’s a com­plete dis­rup­tion that could tank your busi­ness – and will if you don’t pre­pare cor­rect­ly.”

To find out more please vis­it zerto.com.