Full Report
This year for World Backup Day, we’ve asked our friends and backup/disaster recovery experts at Servosity to share their best “backup” tips.
Analysis Summary
# Best Practices: Disaster Recovery and Data Backup
## Overview
These practices address the critical need for resilient data recovery mechanisms to counter rising ransomware threats and cyberattacks. They shift the focus from simple data storage to "Disaster Recovery (DR) Imaging," ensuring business continuity rather than just data preservation.
## Key Recommendations
### Immediate Actions
1. **Verify the 3-2-1 Rule:** Ensure you have at least three copies of data, stored on two different media types, with at least one copy located offsite.
2. **Audit Current Backup Types:** Identify if you are using "File Backup" vs. "DR Imaging." Prioritize switching critical systems to DR Imaging to capture OS, applications, and configurations.
3. **Perform a Manual Restore Test:** Select a random critical file or volume and attempt a full restoration to verify data integrity immediately.
### Short-term Improvements (1-3 months)
1. **Automate Daily Testing:** Move beyond checking "success" screenshots. Implement automated boot testing or recovery verification to ensure backups are actually bootable.
2. **Establish Local Virtualization:** Configure systems to "spin up" locally as a virtual machine (VM). This allows for immediate recovery without waiting for a full data restore/download.
3. **Harden Hypervisors:** If using virtualized environments (like ESXi), implement runtime controls and simplify patching processes to prevent ransomware from targeting the host.
### Long-term Strategy (3+ months)
1. **Orchestrated Recovery Planning:** Develop a formal Disaster Recovery Plan that dictates the order of operations for spinning up systems in the cloud during a total site failure.
2. **Vendor Evaluation:** If internal resources cannot support daily testing, outsource backup management to a specialized partner to ensure 24/7 monitoring and validation.
3. **Cyber Insurance Alignment:** Review backup protocols against insurance requirements to ensure coverage eligibility in the event of a breach.
## Implementation Guidance
### For Small Organizations (SMBs)
- **Focus on Automation:** Use tools that handle the "mundane" tasks of backups automatically, as SMBs often lack dedicated headcount for manual verification.
- **Offline Primary Copies:** Ensure the "1" in the 3-2-1 rule is truly disconnected from the network to prevent ransomware from encrypting the backups themselves.
### For Medium Organizations
- **Local DR Imaging:** Implement on-site appliances that allow for "Instant Recovery" to minimize downtime for employees.
- **VSS Optimization:** For Windows environments, audit Microsoft Volume Shadow Copy Service (VSS) settings to ensure they are not the sole point of failure.
### For Large Enterprises
- **Hypervisor Hardening:** Focus on securing the infrastructure layer (ESXi/Hyper-V) and implementing strict access controls to prevent administrative compromise.
- **Cloud Failover:** Maintain a synchronized cloud environment where the entire infrastructure can be virtualized if the primary data center is compromised.
## Configuration Examples
- **DR Imaging vs. File Backup:** Configure backups to capture the entire **Block Level** (C: Drive/Volume) rather than specific folders.
- **Virtual Boot:** Configure your backup software to perform a "Daily Screenshot Verification" where the backup is automatically booted in a sandbox to prove the OS reaches the login screen.
## Compliance Alignment
- **NIST Cybersecurity Framework:** Directly supports the "Recover" function.
- **CIS Controls:** Aligns with Control 11 (Data Recovery).
- **ISO/IEC 27001:** Supports Annex A.17 (Information Security Continuity).
## Common Pitfalls to Avoid
- **Relying on "Success" Emails:** A backup report may say "Successful" even if the data is corrupted or unbootable.
- **Over-reliance on Cloud-Only Backups:** Without a local copy, recovery time objectives (RTO) will fail if you have to download terabytes of data over a standard internet connection.
- **Neglecting the OS:** Only backing up data files (Word/Excel) requires you to manually reinstall Windows and all apps during a crash, leading to days of downtime.
## Resources
- **Servosity Backup Tools:** hxxps[://]www[.]servosity[.]com/
- **Huntress Blog (Tradecraft):** hxxps[://]www[.]huntress[.]com/blog
- **Microsoft VSS Best Practices:** hxxps[://]www[.]huntress[.]com/blog/microsoft-vss-limits-and-best-practices
- **Hypervisor Hardening Guide:** hxxps[://]www[.]huntress[.]com/blog/hypervisor-defenses-against-ransomware-targeting-esxi