Making operational continuity central to an effective counter-ransomware strategy

Christopher Rogers at Zerto a Hewlett Packard Enterprise company explains why maintaining business continuity is the central reason for investing in data protection

 

Cyber-security remains very much in the spotlight. In line with the concerning prediction by Cybersecurity Ventures that there will be a ransomware attack on businesses every 11 seconds, ransomware attacks have skyrocketed over the last couple of years, increasing by 150% in 2020 alone.

 

According to IDC’s research, about 50% of organisations suffered an unrecoverable data loss in the last three years and cyber attacks surged 238% between February and April 2020. IDC has dubbed ransomware ‘the most challenging area of data protection’.

 

However, it’s not only the prevalence of attacks that keeps CIOs awake at night – the costs are spiralling. Cybersecurity Ventures noted in November 2020 that the latest forecast is for global ransomware damage costs to reach $265 billion by 2031.

 

Minimising downtime is the key

Irrespective of size, location, or industry, the one issue all organisations agree on is that time is money. One of the most expensive consequences of a ransomware attack is downtime, with a staggering 21 days being the average downtime organisations experience after an attack. Downtime caused by data loss means total paralysis for organisations, and rapid recovery time should be the most important goal of any disaster recovery solution.

 

In October 2021, the online activities of 3.5 billion people and small businesses worldwide ground to a halt. Meta services – Facebook, Instagram and WhatsApp – were inexplicably offline for around six hours. Although that outage was blamed on networking issues, it illustrates the impact on consumers and businesses when operations are shut down.

 

All organisations must invest in data protection and recovery strategies - not just as a box-ticking compliance exercise, but to protect their assets.

 

SLAs for recovery must be minutes not hours

When attacks are reported, the first reference is usually to data loss as the primary repercussion. However, it’s availability that really takes the hit. Business-critical applications and services run on data, which must be recovered as quickly as possible.

 

Data backups have evolved from tape and remote disc devices to cloud-based services, commonly updated at a specific time daily, weekly, or hourly. Classic once-daily backups have become irrelevant for maintaining seamless services.

 

Meanwhile, cyber criminals’ intelligence has evolved to use ransomware to attack local backups, another threat for organisations to rapidly recover services.

 

Building an effective continuous data protection strategy

It’s one thing for a business to have a recovery plan in place. It’s another to have a proactive robust strategy to minimise the risk of being targeted and to limit the fallout if it does. Cyber-security teams can’t afford to overlook an approach to continuous availability and one of the most effective ways is to implement continuous data protection (CPD).

 

Organisations are turning to CDP to protect their most important workloads. CDP has always-on replication and journaling technology which ensures the protection of every change that’s made to an application in real-time. A CDP solution can enable recovery of an organisation’s entire site and applications within a few minutes to a state seconds before an attack.

 

Several key considerations are vital for an effective CDP journey:

• Aim for recovery in minutes. Adopting a zero-tolerance approach to downtime and data loss is vital. When implementing CDP, organisations must aim for recovery within a matter of minutes instead of hours to ensure normal business processes are resumed quickly with the most minimal disruption.
• Understand the organisation’s risk factors. Knowing the vulnerabilities and how those can put an organisation at risk for ransomware attacks is vital to planning how to offset attacks. Testing is vital for de-risking any recovery plan and CDP solutions make it easy to perform failover testing quickly and without disruption.
• Consider workload mobility. This means assessing how modernised the organisation’s infrastructure is, and whether teams can move virtual machines from one environment to another without interruption or downtime. Ask whether they are truly able to handle migration and consolidation projects where data may be put at risk.
• Move to the cloud. Using the public cloud for immutable offsite copies brings additional, safe recovery options. Organisations will benefit from moving applications from on-premises environments to public cloud services.

 

Staying a step ahead of ransomware attacks

As organisations prepare for “not if, but when” ransomware attacks, it’s important to have a goal beyond just data recovery. Achieving operational continuity after an attack is one of the most beneficial processes an organisation can establish.

 

It’s not enough to say that forewarned is forearmed. With cyber criminal capabilities growing every minute, IT teams incorporate CDP in their counter-ransomware strategy to be a step ahead.

 

---

 

Christopher Rogers is a Technology Evangelist at Zerto a Hewlett Packard Enterprise company

 

Main image courtesy of iStockPhoto.com