{"id":15286,"date":"2020-03-13T06:58:21","date_gmt":"2020-03-13T06:58:21","guid":{"rendered":"https:\/\/www.backupassist.com\/blog\/?p=15286"},"modified":"2020-04-29T11:40:31","modified_gmt":"2020-04-29T11:40:31","slug":"backups-and-covid-19-lockdown","status":"publish","type":"post","link":"https:\/\/www.backupassist.com\/blog\/backups-and-covid-19-lockdown","title":{"rendered":"Backups and preparing for a COVID-19 lockdown. How to be cyber-resilient when there\u2019s no one in the office."},"content":{"rendered":"\n

So you\u2019re responsible for managing the\nbackup systems and I.T. infrastructure for your company, and Coronavirus has\nunfortunately razed chaos in your community.<\/p>\n\n\n\n

The country declares a lockdown. Your business institutes a work-from-home policy, and no one will be in the office for the next 2 weeks… and that may well extend into 2 months.<\/p>\n\n\n\n

What should you do to prepare, so that your business remains cyber-resilient?<\/strong><\/p>\n\n\n\n

In this special report, I\u2019ll go through the challenges and downright problems<\/strong> that I see in relation to keeping I.T. infrastructure cyber-resilient during a lockdown, and then some of my suggested recommendations and solutions<\/strong>. <\/p>\n\n\n\n

Table of contents:<\/h2>\n\n\n\n

The problems of a lockdown<\/a>:<\/p>\n\n\n\n

  1. no one is there to swap out the backup disks<\/a><\/li>
  2. when the cat\u2019s away, the mice will play – hackers, thieves, saboteurs<\/a><\/li>
  3. slower detection of ransomware events<\/a><\/li><\/ol>\n\n\n\n

    Your goals and requirements for good cyber-resilience<\/a><\/p>\n\n\n\n

    Recommendations for how to stay cyber-resilient<\/a>:<\/p>\n\n\n\n

    1. make sure you have an offsite and offline \u201cbaseline recovery point\u201d as close as possible to the office lockdown date<\/a><\/li>
    2. perform automated file backups to the cloud during the shutdown period \u2013 to minimize potential data loss<\/a><\/li>
    3. activate SMS alerts in CryptoSafeGuard to be notified of ransomware events<\/a><\/li>
    4. power down machines that don\u2019t need to be on<\/a><\/li><\/ol>\n\n\n\n

      \u2022 \u2022 \u2022<\/p>\n\n\n\n

      <\/div>\n\n\n\n

      <\/p>\n\n\n\n

      The problems of a lockdown<\/h2>\n\n\n\n

      The unique circumstances of the current Coronavirus lockdowns presents challenges to cyber-resilience. Let\u2019s explore them now.<\/p>\n\n\n\n

      <\/div>\n\n\n\n

      Problem 1: no one will swap out the backup disks<\/h3>\n\n\n\n

      This is obvious \u2013 for the many small\nbusinesses who back up to USB Hard Drive, RDX cartridges or tape, there just\nwon\u2019t be anyone at the office to swap the backup devices out.<\/p>\n\n\n\n

      So if everyone just packs up and leaves the\noffice, the same backup device will remain connected, and your backups will\ncontinuously get overwritten. Therefore, your previously solid backup strategy\nwill break down quickly\u2026<\/p>\n\n\n\n

      If you are relying on swapping out the backup device to get an offsite and\/or offline backup, you\u2019ll need to make alternative arrangements (discussed later) to achieve the same level of cyber-resilience.<\/p>\n\n\n\n

      <\/div>\n\n\n\n

      Problem 2: when the cat\u2019s away, the mice will play – hackers, thieves, saboteurs<\/h3>\n\n\n\n

      Cyber-resilience involves examining the\nrisks to your I.T. infrastructure, and making sure you can recover in case of\nemergency. Remember that in the case of an office shutdown, there may be fewer\npeople using your I.T. infrastructure, and therefore any nefarious activities may\ngo undetected for longer.<\/p>\n\n\n\n

      Here are some of the possible cyber-events\nthat are made easier when there\u2019s nobody physically around to keep track of\nthings.<\/p>\n\n\n\n

      \"\"<\/td>Threat 1: <\/strong>A hacker breaks into your network and installs ransomware (the \u2018post-compromise\u2019 ransomware attack)<\/td><\/tr>
      \"\"<\/td>Threat 2: <\/strong>Thieves break into the premises and steal equipment<\/td><\/tr>
      \"\"<\/td>Threat 3: <\/strong>Malicious employees perform sabotage while few people are watching<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

      Add to these are the existing threats such as fire, flood, earthquake, and hurricane.<\/p>\n\n\n\n

      In my opinion, it is the first threat, hacking<\/strong>, that poses the biggest risk<\/strong> in a COVID-19 lockdown. As more and more people get set up with \u201cwork from home\u201d arrangements, more companies will be relying on Remote Desktop and other 3rd<\/sup> party remote access tools<\/strong>. Any small misconfigurations in firewalls<\/strong>, or problems such as weak passwords<\/strong>, can make it easier for hackers to break in.<\/p>\n\n\n\n

      As with any successful hacking attack, any backups that are online (that is, connected to or accessible from any computer on your network) are vulnerable to being deleted.<\/p>\n\n\n\n

      <\/div>\n\n\n\n

      Problem 3: slower detection of a ransomware event<\/h3>\n\n\n\n

      Normally, detecting a ransomware event is\neasy. Staff come into work. They try to log into their PCs, and they see ransom\nnotes all over the place.<\/p>\n\n\n\n

      \"\"
      Example of a ransomware note.<\/strong> <\/figcaption><\/figure><\/div>\n\n\n\n

      However, in a lockdown situation, it might\nnot be so straightforward. It might be that operations are closed and staff\ndon\u2019t work, so there\u2019s nobody to find the infection. Or in work-from-home\nsituations, the ransomware strain might have disabled remote access, so the\nransom message is not visible.<\/p>\n\n\n\n

      If a ransomware event happens while no one is around, you\u2019ll still need to know about it and take action accordingly.<\/p>\n\n\n\n

      \u2022 \u2022 \u2022<\/p>\n\n\n\n

      <\/div>\n\n\n\n

      Your goals and requirements for good cyber-resilience<\/h2>\n\n\n\n

      The overarching goal in cyber-resilience is\nto be able to recover your systems in the case of a cyber event.<\/p>\n\n\n\n

      You can then break down that overall goal\ninto smaller bite-sized goals:<\/p>\n\n\n\n

      \"\"<\/td>Goal 1:<\/strong> To have a valid backup to recover from, and to make sure that backup is secure from hackers, thieves and malicious employees.<\/td><\/tr>
      \"\"<\/td>Goal 2:<\/strong> To lose as little data as possible.<\/td><\/tr>
      \"\"<\/td>Goal 3:<\/strong> To recover in the fastest time possible.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

      All these three points should make perfect sense. Achieving these goals within the constraints of a COVID-19 lockdown is possible with a little extra preparation.<\/p>\n\n\n\n

      <\/p>\n\n\n\n

      <\/div>\n\n\n\n

      \u2022 \u2022 \u2022<\/p>\n\n\n\n

      Recommendations and solutions<\/h2>\n\n\n\n

      Here are my recommendations on some of the best ways to remain cyber-resilient during times of a COVID-19 office shutdown. You should take these recommendations and use them or adapt them to your own scenarios. <\/p>\n\n\n\n

      <\/div>\n\n\n\n

      Recommendation 1: make sure you have an offsite and offline \u201cbaseline recovery point\u201d as close as possible to the office lockdown date. <\/h3>\n\n\n\n

      For most businesses, this backup should be\na full system backup (a system image is fine) that is disconnected from the\nmachine, taken offline and offsite.<\/p>\n\n\n\n

      Why do a baseline backup?<\/h4>\n\n\n\n
      1. It\u2019s important to take this\nbackup offline, because if the office is unattended for weeks, that is a good\nopportunity for hackers to penetrate the network and destroy the backups.\nRemember, a hacker cannot sabotage a hard drive or RDX cartridge that is\nsitting on a shelf! This addresses Problem #2.<\/li>
      2. Taking the backup offsite and\nstoring it either in a safe place (like a safety deposit box) or a place that\u2019s\ninhabited can mitigate against theft or looting. This addresses Problem #2.<\/li>
      3. A system image is generally the\nfastest way to do a full system recovery, just in case you need to. (This\nsatisfies Goals 1 & 3)<\/li><\/ol>\n\n\n\n

        How to do your baseline backup<\/h4>\n\n\n\n

        I recommend that this backup is an additional<\/strong> backup to the system you are currently running. Even for larger data sets, an 8TB hard disk retails for around $150, so it is very affordable to take a special, one-off backup for your baseline recovery point. Just configure another system protection job in BackupAssist, and run a manual backup.<\/p>\n\n\n\n

        This will mean you can recover to the point\nof the start of the lockdown. But what about work done after the lockdown begins?\nThat\u2019s where my next recommendation comes in.<\/p>\n\n\n\n

        \"\"
        Baseline System Protection<\/strong> backup job for a server.
        To learn more, see our System Protection documentation<\/a>. <\/figcaption><\/figure>\n\n\n\n
        <\/div>\n\n\n\n

        Recommendation 2: perform automated file backups to the cloud during the shutdown period \u2013 to minimize potential data loss.<\/h3>\n\n\n\n

        When there\u2019s nobody to swap out hard disks, you\u2019ll have to rely on fully automated backups. You can think of these as a \u201ctop up\u201d backup \u2013 your offline system image can be used to recover to the point of the lockdown, and these automated file backups will enable you to incrementally recover to the most recent cloud backup.<\/p>\n\n\n\n

        Why backups to the cloud?<\/h4>\n\n\n\n
        1. Backups to the cloud are\nautomatically offsite<\/strong>. This addresses Problem #2.<\/li>
        2. Performing these automated\nbackups will minimize potential data loss<\/strong>. This addresses Goal #2.<\/li>
        3. No one is required to make this\nhappen. This addresses Problem #1.<\/li>
        4. Unlike other forms of local\nautomated backup (for example, to NAS, or DAS), there is a higher level of\nresilience in the case of a hacking attempt. Many automated ransomware\ninfection systems will scan and seek out NAS devices. Backups stored in the\ncloud are safer in that respect (although not entirely hacker-proof, if the\nhacker manages to steal your cloud account credentials. That\u2019s where 2FA on\nyour cloud account becomes important.)<\/li><\/ol>\n\n\n\n

          How to set up backups to the cloud<\/h4>\n\n\n\n

          There are several different options on how to achieve this \u2013 which differ depending if you want to back up all your files, or only the most recent files that have changed since your baseline recovery point. This in turn depends on how big your data set is \u2013 this will be your call, but I\u2019ll present the different options here. <\/p>\n\n\n\n

          Option 1: back up all selected files and applications (regardless of how old they are)<\/h5>\n\n\n\n
          1. If you use BackupAssist and are happy to back up to Amazon AWS S3 or Microsoft Azure: set up a cloud backup job. Configure the job by selecting whatever files and folders you want to back up. Note \u2013 this requires the BackupAssist Cloud Offsite add-on. <\/li><\/ol>\n\n\n\n
            \"\"
            Example – backing up to Amazon S3. Of course you can also choose Microsoft Azure.<\/figcaption><\/figure><\/div>\n\n\n\n
            1. If you prefer to use other cloud storage options, you can follow these steps to perform a local file backup to local storage, and then use a file sync app to sync them offsite:<\/li><\/ol>\n\n\n\n
              \"\"<\/td>Firstly, create a new directory to somewhere where you can store a mirror of your files. Then set up a File Protection job in BackupAssist to back up your selected files and applications to that directory.<\/td><\/tr>
              \"\"<\/td>Second, install your chosen cloud sync application to sync that directory to the cloud. Common choices include the OneDrive app, Google Drive, Dropbox and OwnCloud sync tools.<\/td><\/tr>
              \"\"<\/td>Finally, if you want a 3rd<\/sup> copy of your files, then use BackupAssist 365 to then download the cloud copy of files back to a local destination. BackupAssist 365 currently supports downloading files from OneDrive, OneDrive for Business and SharePoint.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
              \"\"
              Daily Cloud Backup <\/strong>job for selected files and applications.
              To learn more, see our Cloud Backup documentation<\/a>. <\/figcaption><\/figure>\n\n\n\n
              Option 2: back up only the most recent files<\/strong> with the help of robocopy. <\/h5>\n\n\n\n
              \"\"
              Back up only recently changed files to a local disk using Robocopy. Then back up that backup to the cloud. This two-stage process reduces the amount of data backed up dramatically – saving time and storage costs.<\/figcaption><\/figure><\/div>\n\n\n\n

              This can be a great option if you have a huge data set, and need to get your cloud backups going FAST. After all, it\u2019s much faster to upload 1GB of data than 500GB. You\u2019ll need to firstly do a local backup of these files, and then you can back up that local backup to the cloud.<\/p>\n\n\n\n

              This option uses the \u201crobocopy\u201d tool to copy recently changed files to the local backup directory. <\/p>\n\n\n\n