{"id":988871,"date":"2026-10-06T11:00:00","date_gmt":"2026-10-06T07:00:00","guid":{"rendered":"https:\/\/techservice.ge\/?p=988871"},"modified":"2026-10-05T21:26:57","modified_gmt":"2026-10-05T17:26:57","slug":"backup-data-security-business","status":"publish","type":"post","link":"https:\/\/techservice.ge\/en\/backup-data-security-business\/","title":{"rendered":"Backup \u2260 Security \u2013 Why isn&#039;t Backup Enough?"},"content":{"rendered":"<div class=\"vgblk-rw-wrapper limit-wrapper\">\n<p class=\"wp-block-paragraph\">In many companies, the first response to data protection issues is:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u201e&quot;We have backup.&quot;\u201c<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is good \u2013 but not enough.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Backup comes first. <strong>Data recovery mechanism<\/strong>. It helps you recover lost or damaged data after an incident has already occurred.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cybersecurity is a much broader process. Its goal is to reduce the likelihood that an attacker will gain access to your systems, user accounts, servers, and data at all.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That&#039;s why:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Backup \u2260 security.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A more correct formula is:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Cybersecurity + Secure Backup + Tested Recovery = Real Business Resilience.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CISA recommends that organizations back up critical data offline and in an encrypted environment and regularly verify both the integrity and restoreability of backups. One reason for this is that some ransomware actively attempts to discover, delete, or encrypt backups available on the network.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why can&#039;t Backup replace cybersecurity?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Imagine a company that automatically runs a backup every night.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At first glance, everything is arranged correctly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But the employee&#039;s account was compromised in a phishing attack. The attacker gains access to the system, moves through the company&#039;s network, steals user data, and finally encrypts the servers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this case, Backup can help you restore the server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But Backup cannot undo the fact that the attacker already had access to the system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It cannot recover data that has already been stolen.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cannot change compromised passwords.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cannot shut down an unprotected server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It won&#039;t stop the same attacker from coming back again.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Modern ransomware attacks often go beyond just encrypting data. In the incidents described by CISA, attackers first extract data from a system and then encrypt it using so-called. <strong>double extortion<\/strong> Model. Therefore, backup can help you restore availability, but it cannot ensure data confidentiality or overall cybersecurity.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Another problem: what if the ransomware also reached the backup?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">One of the most common mistakes is storing backups in the same environment where the main data is stored.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Work computers are connected to a central server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The server is connected to a NAS device.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Backup is stored on NAS.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The same or related credentials are used to administer all of them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If an attacker gains high enough access, they may be able to delete or encrypt backups in addition to the primary data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The FTC recommends that businesses store backups off-site and use separate credentials for backups. CISA also recommends offline, encrypted, and, if possible, immutable backups.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That&#039;s why one NAS, one VPS snapshot or one Cloud Drive automatically <strong>No complete backup strategy<\/strong>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Files stored in the cloud are not always backed up.<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Here is another important difference:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Cloud Storage\/Sync and Cloud Backup are not the same thing.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Google Drive, OneDrive, Dropbox, and other synchronization systems are very useful for everyday work, but their main purpose is often to access and synchronize files.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If a file deletion or change is automatically synced to other devices, an error or malicious change could also spread.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, it is desirable for businesses to use mechanisms such as:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>versioning, retention, independent backup, delete protection and immutable\/object lock storage.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CISA specifically recommends that organizations use delete protection or object lock in cloud storage and, where possible, version control to allow for the recovery of a previous version of a file after an accidental or malicious change.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cloud infrastructure is also important <strong>of the shared responsibility model<\/strong> Understanding: The reliability of a cloud provider&#039;s infrastructure does not automatically mean that your specific data backup strategy is also properly configured.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is the 3-2-1 Backup Strategy?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">One of the most well-known approaches to backup architecture is <strong>The 3-2-1 principle<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The idea is simple:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Have at least data <strong>3 copies<\/strong> Working data and at least two backups;<\/li>\n\n\n\n<li>Data should be stored for at least <strong>On 2 different types of storage or environments<\/strong>;<\/li>\n\n\n\n<li>At least <strong>1 copy should be located in an off-site or offline environment separate from the main infrastructure<\/strong>.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">The 3-2-1 approach is also presented as a practical strategy for recovering from ransomware in recommendations published by CISA.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, for a small or medium-sized business, this might look like this:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Primary:<\/strong> Company server or cloud infrastructure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Backup #1 \u2013 Online:<\/strong> Independent Cloud Backup Storage.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Backup #2 \u2013 Offline\/Off-site:<\/strong> An encrypted external drive or other storage that is not permanently connected to the company network.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This significantly reduces the likelihood of losing all three copies simultaneously in a single incident.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why do we need both Online and Offline Backup at the same time?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Both perform different tasks.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Online Backup \u2013 for quick recovery<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Online Backup is available continuously or periodically for an automated system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Its main advantage is speed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If an employee accidentally deletes a file, there is a technical problem on the server, or you need to revert to the last version, Restore from Online Backup can often be done quickly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But since this storage is accessible via the internet or network, it is also necessary to protect it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Requires a separate administrative account, MFA, minimal privileges, encryption, monitoring, versioning, and, if possible, immutable retention.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Offline Backup \u2013 The Last Layer of Protection<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Offline Backup is not constantly connected to the network.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, an external drive is used to create a backup, and once complete, the device is turned off and stored in a safe place.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CISA specifically recommends that users not leave external backup drives permanently connected to their computers, as ransomware may also be able to access them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Offline Backup is especially important in scenarios where an attacker already has administrator-level control over a company&#039;s infrastructure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Off-site and Offline are not the same thing<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">These two terms are often confused with each other.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Off-site Backup<\/strong> It means that a copy of the data is placed in another physical or logical location.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, your main server is in Tbilisi, and your backup is stored in another datacenter or with a cloud provider.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Offline Backup<\/strong> Means that the storage is not actively connected to the network.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Backup can be simultaneous <strong>offline and off-site<\/strong>, which is a particularly powerful combination for highly critical data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The FTC also notes that care should be taken when choosing a backup location: a copy stored in the same office may not protect you in the event of a fire, flood, theft, or other physical incident.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Having a backup is not enough. Restore must work.<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">One of the most dangerous phrases is:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u201e&quot;Backup completed successfully.&quot;\u201c<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This message can only confirm that the Backup program marked the process as successful.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">He still doesn&#039;t answer the most important question:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Can you actually recover the data?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The backup may exist, but be corrupted.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An important database may not be included in the backup at all.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The encryption key may be lost.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The required credentials may no longer exist during the restore.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You may have a full server backup, but the configuration, secrets, applications, or dependencies required for the new infrastructure may not be saved.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One of the core principles of NIST&#039;s Backup Recommendations is not just to create a backup, but to also <strong>maintenance and testing<\/strong>. NIST SP 1339, published in 2026, also emphasizes the regular creation, testing, and verification of backups during recovery exercises.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In other words:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A backup that you will never test is just an assumption.<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What should be checked during a Restore Test?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A proper Restore Test is not just about checking whether a ZIP file can be opened or not.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It must be proven that the data can actually be returned to an independent or clean environment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, if a business has WordPress, CRM, ERP, or other web applications, backing up files alone will often not be enough.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It may be necessary:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Database<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Application files<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Uploads \/ documents<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Configuration<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Environment settings<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DNS information<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SSL\/TLS configuration<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Server configuration<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Application dependencies<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Recovery credentials<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">and other components.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">NIST also emphasizes that recovered data must not only be accessible, but also <strong>Accurate, complete and malware-free<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That is why the Restore procedure must be documented in advance.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">RPO and RTO \u2013 Two Questions Every Business Should Ask<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Backup frequency should not be chosen randomly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For this, two important indicators are used in IT and Business Continuity practice.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">RPO \u2013 Recovery Point Objective<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">RPO answers the question:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How much data loss can we accept?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If a backup is created once a day and the crash occurs 23 hours after the backup was created, almost a day&#039;s worth of data could be lost.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If losing even a single day&#039;s worth of orders, transactions, or customer information is unacceptable for a company, backups should be created more frequently.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">NIST defines RPO as the point in time to which an organization should be able to restore data from the last available backup.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">RTO \u2013 Recovery Time Objective<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">RTO answers another question:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How long will it take for the system to be back up and running?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A backup may be ideal, but if its restore takes 48 hours and the business can tolerate a maximum of four hours of downtime, the architecture cannot meet the requirements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">According to NIST, RTO defines the maximum acceptable period during which a particular IT resource can be unavailable without unacceptable harm to the business.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, backup strategy is not a technical issue, <strong>It&#039;s also a business decision.<\/strong>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The backup itself must be protected.<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Backups often contain a company&#039;s most important information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CRM users.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Financial documents.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Employee information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Databases.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Contracts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Email.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Projects.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sometimes credentials and configuration files too.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, gaining access to Backup Storage is as valuable to an attacker as gaining access to the Production Server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An effective backup architecture should therefore include:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Encryption at rest<\/strong> \u2013 Data must be encrypted in storage.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Encryption in transit<\/strong> \u2013 Backup transmission should also be done via a secure channel.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>MFA<\/strong> \u2013 Especially on administrative accounts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Separate Credentials<\/strong> \u2013 For the backup system, accounts independent of the production environment are preferred.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Least Privilege<\/strong> \u2013 The user and service should only have access to what they actually need.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Immutability \/ Object Lock<\/strong> \u2013 Restricting changes or deletions to a backup for a specified period of time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Logging &amp; Alerts<\/strong> \u2013 Detecting backup deletion, modification, or unusual administrative action.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Versioning<\/strong> \u2013 Storing multiple historical versions of data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The FTC also recommends that businesses encrypt sensitive information and backup media, use strong authentication, and implement MFA.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Immutable Backup \u2013 Why has it become particularly important?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Immutable means data whose modification or deletion is impossible or strictly limited for a specified period of time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, an organization may have a daily backup that cannot be changed for 30 days.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If an attacker has taken over an administrator account and encrypted production data, their next step is often to attempt to destroy the backup.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the backup is a regular writable storage, this may be possible.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Immutable Storage creates an additional barrier.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CISA recommends that organizations use immutable backup and, in the case of cloud storage, delete protection or object lock, where technically possible.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, immutable backup does not mean that other security controls are no longer needed. Incorrect retention policy, credential compromise, or configuration error still remain a problem.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Backup cannot replace Endpoint, Network, and Account Security<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A strong backup architecture is just one layer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Real protection of business data also requires timely updates to systems and software, MFA, endpoint protection, access control, network segmentation, vulnerability management, logging and monitoring, employee training against phishing, and an Incident Response Plan.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The FTC recommends this multi-layered approach for small businesses: software updates, data backups, encryption, MFA, access control, employee training, and pre-prepared incident response\/recovery plans are complementary controls, not substitutes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Backup helps you when security fails to stop an incident.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Security Controls also reduce the likelihood that you will need to use Backup at all.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What should a business have at least?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A practical minimum model for small and medium-sized businesses could be:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Automatic, regular backup for critical systems;<\/li>\n\n\n\n<li>At least two additional copies with a 3-2-1 approach;<\/li>\n\n\n\n<li>Independent Cloud\/Off-site Backup;<\/li>\n\n\n\n<li>Offline or Immutable Backup for critical data;<\/li>\n\n\n\n<li>Backup Storage Encryption;<\/li>\n\n\n\n<li>Separate Backup Credentials and MFA;<\/li>\n\n\n\n<li>Versioning and appropriate Retention Policy;<\/li>\n\n\n\n<li>Backup Job Monitoring and Failure Alert;<\/li>\n\n\n\n<li>Periodic Restore Test;<\/li>\n\n\n\n<li>Documented RPO and RTO;<\/li>\n\n\n\n<li>Incident Response and Disaster Recovery Procedure;<\/li>\n\n\n\n<li>Pre-determine critical systems, data, and recovery priorities.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The same Backup Frequency or Retention Period will not be right for every business. It should be determined based on the importance of the data, the frequency of change, legal requirements, and the amount of downtime that the business is willing to accept.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Backup Monitoring \u2013 Who verifies that the backup was actually performed?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Automation is useful, but &quot;it works automatically&quot; and &quot;no longer requires control&quot; are not the same thing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A backup job may be down for weeks due to storage filling up, authentication errors, API changes, missing permissions, or other technical issues.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you only discover this during the incident, it&#039;s already too late.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, the organization should have monitoring that checks not only whether the backup has started, but also:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Was it completed successfully?;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">How much data did you save?;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When was the last successful backup performed?;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Is Storage Enough?;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Did the Backup Size change suddenly?;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Does retention work?;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">and whether the Restore Test completes successfully.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The person responsible for backup should also be determined in advance.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Disaster Recovery Plan \u2013 What happens after a backup?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In the event of a serious incident, simply knowing the backup address is not enough.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There must be answers to the questions:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Which system will be restored first?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Where will the new server be created?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Who manages DNS?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Who has the necessary credentials?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">How do we determine that Backup is not infected?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">How will the new environment be isolated from the old?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When can users be allowed back into the system?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">How do we verify the integrity of the database?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Who should be notified of the incident?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">NIST describes contingency planning as a coordinated strategy that includes plans, procedures, and technical measures to recover systems, operations, and data after a disruption.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CISA recommends that after a ransomware attack, organizations begin the restore from a known clean, offline, and encrypted backup, and take special care to ensure that the clean system is not reinfected during the restore process.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">One simple scenario<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Imagine a company whose:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Website and CRM run on Cloud Server;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Files are saved to Cloud Storage daily;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The database is backed up every few hours;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Another copy of the daily backup is sent to an independent storage provider;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Critical Backup is stored in Immutable mode;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An offline copy is also created periodically;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">All backups are encrypted;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A separate Production account and MFA are used for Backup administration;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">And the company periodically performs a Restore Test.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the Production Server crashes, Online Backup allows for quick system recovery.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If both the Production and Online environments are compromised at the same time, an Immutable or Offline Backup remains as an additional layer of protection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is what resilience is.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Not just one backup file but <strong>Several independent ways to restore<\/strong>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently Asked Questions<\/h2>\n\n\n\n<h2 class=\"wp-block-heading\">Is Backup Cybersecurity?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Backup is an important part of cybersecurity, but it is not a complete security system in itself. It mainly serves recovery, while other controls such as MFA, patching, access control, endpoint security, monitoring, and other mechanisms provide attack prevention.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Is Cloud Backup Enough?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Cloud Backup is a powerful component, but storing a single copy in a single Cloud account creates additional risk. For critical data, it is also desirable to have an independent or offline\/immutable backup.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How many backups should a company have?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">One widely used approach is the 3-2-1 principle: three copies of data, two different types of environments, and at least one off-site or offline copy.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Why shouldn&#039;t an External Drive be permanently connected?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Because a compromised computer or ransomware could also access the connected drive and delete or corrupt the backup, CISA recommends that users disconnect the external backup drive after an active backup is complete.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How often should a backup be checked?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">There is no universal frequency. Test Frequency should be consistent with the criticality of the data, RPO\/RTO requirements, and frequency of changes. The main principle is that Restore Tests should be regular and documented. NIST and CISA both emphasize the importance of regular testing.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What does a successful backup mean?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A successful backup means not only creating a file, but also that the copy is complete, secure, accessible at the right time, and that the system can be successfully restored from it.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Conclusion: Don&#039;t just ask &quot;Do we have backup?&quot;\u201e<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">The correct questions are:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Where is our backup stored?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Can an attacker access it with the same account?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Do we have independent Online and Offline\/Immutable copies?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Is the data encrypted?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Does MFA work?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>When did we last perform a Restore Test?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How much data can we afford to lose, i.e. what is our RPO?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How long can we restore the system, i.e. what is our RTO?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>And if tomorrow all the basic infrastructure becomes inaccessible, do we know exactly what to do?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If there are no answers to these questions, just knowing that &quot;backups are being made somewhere&quot; is not enough for business security.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Modern data protection must include <strong>Prevention, protection, monitoring, backup, isolation, testing and planned recovery<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That&#039;s when Backup turns from a simple file copy into a real one. <strong>Business Continuity and Disaster Recovery System<\/strong>.<\/p>\n<\/div><!-- .vgblk-rw-wrapper -->","protected":false},"excerpt":{"rendered":"<p>\u10d1\u10d4\u10d5\u10e0 \u10d9\u10dd\u10db\u10de\u10d0\u10dc\u10d8\u10d0\u10e8\u10d8 \u10db\u10dd\u10dc\u10d0\u10ea\u10d4\u10db\u10d7\u10d0 \u10d3\u10d0\u10ea\u10d5\u10d8\u10e1 \u10e1\u10d0\u10d9\u10d8\u10d7\u10ee\u10d6\u10d4 \u10de\u10d8\u10e0\u10d5\u10d4\u10da\u10d8 \u10de\u10d0\u10e1\u10e3\u10ee\u10d8\u10d0: \u201eBackup \u10d2\u10d5\u10d0\u10e5\u10d5\u10e1.\u201c \u10d4\u10e1 \u10d9\u10d0\u10e0\u10d2\u10d8\u10d0 &#8211; \u10db\u10d0\u10d2\u10e0\u10d0\u10db \u10d0\u10e0\u10d0\u10e1\u10d0\u10d9\u10db\u10d0\u10e0\u10d8\u10e1\u10d8. Backup \u10de\u10d8\u10e0\u10d5\u10d4\u10da \u10e0\u10d8\u10d2\u10e8\u10d8 \u10d0\u10e0\u10d8\u10e1 \u10db\u10dd\u10dc\u10d0\u10ea\u10d4\u10db\u10d4\u10d1\u10d8\u10e1 \u10d0\u10e6\u10d3\u10d2\u10d4\u10dc\u10d8\u10e1 \u10db\u10d4\u10e5\u10d0\u10dc\u10d8\u10d6\u10db\u10d8. \u10d8\u10e1 \u10d2\u10d4\u10ee\u10db\u10d0\u10e0\u10d4\u10d1\u10d0\u10d7 \u10e3\u10d9\u10d5\u10d4 \u10db\u10dd\u10db\u10ee\u10d3\u10d0\u10e0\u10d8 \u10d8\u10dc\u10ea\u10d8\u10d3\u10d4\u10dc\u10e2\u10d8\u10e1 \u10e8\u10d4\u10db\u10d3\u10d4\u10d2 \u10d3\u10d0\u10d9\u10d0\u10e0\u10d2\u10e3\u10da\u10d8 \u10d0\u10dc \u10d3\u10d0\u10d6\u10d8\u10d0\u10dc\u10d4\u10d1\u10e3\u10da\u10d8 \u10db\u10dd\u10dc\u10d0\u10ea\u10d4\u10db\u10d4\u10d1\u10d8\u10e1 \u10d3\u10d0\u10d1\u10e0\u10e3\u10dc\u10d4\u10d1\u10d0\u10e8\u10d8. \u10d9\u10d8\u10d1\u10d4\u10e0\u10e3\u10e1\u10d0\u10e4\u10e0\u10d7\u10ee\u10dd\u10d4\u10d1\u10d0 \u10d9\u10d8 \u10d2\u10d0\u10ea\u10d8\u10da\u10d4\u10d1\u10d8\u10d7 \u10e4\u10d0\u10e0\u10d7\u10dd \u10de\u10e0\u10dd\u10ea\u10d4\u10e1\u10d8\u10d0. \u10db\u10d8\u10e1\u10d8 \u10db\u10d8\u10d6\u10d0\u10dc\u10d8\u10d0 \u10e8\u10d4\u10d0\u10db\u10ea\u10d8\u10e0\u10dd\u10e1 \u10d8\u10db\u10d8\u10e1 \u10d0\u10da\u10d1\u10d0\u10d7\u10dd\u10d1\u10d0, \u10e0\u10dd\u10db \u10d7\u10d0\u10d5\u10d3\u10d0\u10db\u10e1\u10ee\u10db\u10d4\u10da\u10db\u10d0 \u10e1\u10d0\u10d4\u10e0\u10d7\u10dd\u10d3 \u10db\u10d8\u10d8\u10e6\u10dd\u10e1 \u10ec\u10d5\u10d3\u10dd\u10db\u10d0 \u10d7\u10e5\u10d5\u10d4\u10dc\u10e1 \u10e1\u10d8\u10e1\u10e2\u10d4\u10db\u10d4\u10d1\u10d6\u10d4, \u10db\u10dd\u10db\u10ee\u10db\u10d0\u10e0\u10d4\u10d1\u10da\u10d4\u10d1\u10d8\u10e1 \u10d0\u10dc\u10d2\u10d0\u10e0\u10d8\u10e8\u10d4\u10d1\u10d6\u10d4, \u10e1\u10d4\u10e0\u10d5\u10d4\u10e0\u10d4\u10d1\u10d6\u10d4 \u10d3\u10d0 \u10db\u10dd\u10dc\u10d0\u10ea\u10d4\u10db\u10d4\u10d1\u10d6\u10d4. \u10e1\u10ec\u10dd\u10e0\u10d4\u10d3&#8230;<\/p>","protected":false},"author":2,"featured_media":988872,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","page_builder":"","footnotes":""},"categories":[64,4,58],"tags":[],"class_list":["post-988871","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud-infrastructure","category-expert-advice","category-it-services"],"_links":{"self":[{"href":"https:\/\/techservice.ge\/en\/wp-json\/wp\/v2\/posts\/988871","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techservice.ge\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techservice.ge\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techservice.ge\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/techservice.ge\/en\/wp-json\/wp\/v2\/comments?post=988871"}],"version-history":[{"count":3,"href":"https:\/\/techservice.ge\/en\/wp-json\/wp\/v2\/posts\/988871\/revisions"}],"predecessor-version":[{"id":988874,"href":"https:\/\/techservice.ge\/en\/wp-json\/wp\/v2\/posts\/988871\/revisions\/988874"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techservice.ge\/en\/wp-json\/wp\/v2\/media\/988872"}],"wp:attachment":[{"href":"https:\/\/techservice.ge\/en\/wp-json\/wp\/v2\/media?parent=988871"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techservice.ge\/en\/wp-json\/wp\/v2\/categories?post=988871"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techservice.ge\/en\/wp-json\/wp\/v2\/tags?post=988871"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}