Ransomware & Backups

Ransomware was first seen in the mid 2000’s and has grown into a prevalent security threat, with TrendMicro reporting they blocked 100 million plus threats between 2015-16.

 What is Ransomeware?

Ransomware is essentially a hijack of the users of machine, that renders it unusable or operating at reduced capacity unless a payment is made. The hijacks fall into two main types of attack, a lockout screen which stops the users accessing any elements of the system until payment is made. In the second type of attack the users files are encrypted and again a ransom is demanded but this time to decrypt the files. The prevalence of these sort of attacks is unfortunately directly linked to that fact they have proved to be a highly effective business for the criminals behind them. We storage administrators have known for some time that both users and organisations data is critically important to them, now unfortunately it seems so do criminals and they are willing to cash in. ZDNet estimated based on Bitcoin transaction information that between 15 October and 18 December CryptoLocker had been used to extort $27 million from victims.


 Infection and removal

The method of infection generally takes two forms, with a machine already compromised with another form of malware triggering the attack or through email. E-mail based attacks will coerce the victim to releasing the pay load via a link or attachment, often by pretending to be from a legitimate source, e.g.click here to see your speeding fine.


In terms of removal the screen locking ransomware is generally easier to remove and can be removed using traditional malware protection products. However once users files have been encrypted this poses a significant challenge. The encryption is often based on a public and private key system, with the private key only known to the hijackers. It is generally impossible to crack these encryption keys, with the only options being to pay the ransom or restore from backup. The police and most security vendors suggest against paying the ransom since it is only fuelling the crime.

 Preventing Ransomeware

Prevention is better than cure and a multi layered approach is suggested.  This would include user education against the threats and giving users the most restrictive rights, so execution is not possible. More direct preventions methods include the use of firewalls, end user protection software and of course keeping patching levels up to date.

 Ransomeware and backups

Given that this is a data protection focused blog I wanted to look at the specific considerations around backup given that this is the predominant recovery method. It is an important consideration that the encryption type software will look to encrypt all attached local and network drives.  The behaviour of encrypting network shares can be particularly damaging to organisation and is why it is important that users are given the most restrictive rights possible so that the ransomware cannot execute.  

Considerations specific to backup are:                                  

Replication is not backup – Sometimes high availability and backup are confused.  Replication is not backup and ransomware is a good example of why not. If the primary end becomes infected, so will the target once replication is competeBear in mind this would include automatic backup to the cloud services.

Hold an offline copy of data – Whilst there have been no confirmed cases of backup software getting hit by an attack ,it is a sensible precaution to protect against a future variant by keeping a backup copy offline or at least in a separate media form.  This is in accordance with the standard good practice laid out in the 3-2-1 rule, have 3 copies of your data, 2 different types of media and one offsite copy.

RPO becomes key – With the random nature of these attacks and the potential level of destruction with multiple key file shares potentially being rendered unusable by a single users, how much data can you afford to lose? For those shares which you consider to be at greater risk perhaps due to the number of users you could consider a shorter RPO. Read this article to learn more about selecting an effective RPO and RTO.

Number of Recovery points – The number of recovery points and retention policy also needs to be considered. If you are using a simple policy of 14 days for example it is possible that an infrequently used share, such as one containing monthly finance reporting may only be noticed by a when time all the backups also contain the encrypted files.

Endpoint backup – If users save files locally to their desktop / laptop consider endpoint protection such as Mozzy or Veeam End point protection to safeguard these devices.



How to choose the correct RPO & RTO for your business


It may seem pedestrian to be covering RPO and RTO. Everyone knows this stuff right? Whilst many readers will already know the dictionary definition, it is commonplace to not fully understand the business implications of these decisions. This article will cover RPO and RTO but with a specific focus on how these terms relate to the business.



RPO stands for Recovery Point Objective, whilst RTO stands for Recovery Time Objective. RPO measures the furthest point away from the current time that you must be able to roll back to. RTO is possibly simpler to understand and measures how quickly the restoration of data must occur. These are the definitions but to understand the implications for a business a better way to think about this is with two questions:

1 What is the maximum amount of data loss that is acceptable to the business? = RPO

2 How long can the business afford to be without the data or the services that rely on that data? =RTO

So I want zero right?

Once most organisations understand RPO + RTO in terms of business impact their next statement will be we cannot afford any data loss and zero down time. Whilst there will be certain circumstances where this is necessary, it will come at a price. In general the closer you get to zero for either measure the higher the cost of the solution will be. The amount of money spent on the solution needs to be proportionate against the financial and other cost of down time .  There may even be circumstances where the cost of protecting the data is more than just starting from scratch.


Not all data is equal

This leads nicely into the next point, not all data is equal. So whilst it may be required to assure minimum down time and zero data loss for financial data this may be less true for users file data. As well as data important to the business, organisations also need to consider industry regulatory and legal requirements around data. For example an organisation holding medical records would most certainly be required to ensure the availability of those records for years to come. Organisations will also need to consider what I would call soft factors, which are harder to measure but would include things like impact on reputation and uniqueness of the data coupled with the ability to recreate it. An example of unique data would be a media company which stores movies.


Putting it all together

Work through the following check points to ensure you select the correct RTO and RPO for your organisation.

  1. Understand the financial impact of down time to help to develop a budget
  2. Understand other impacts of downtime to also consider budget
  3. Understand regulatory and legal obligations
  4. Remember not all data is the same. Classifying it will allow a more targeted RPO/RTO and potentially reduce the cost of the project
  5. Ask how much data can we afford to loose, this is your RPO
  6. Ask how long can we afford for the system to be down, this is your RTO
  7. Remember cost will generally increase the closer you aim to get your RPO & RTO to zero

Stay in touch for more data protection articles by following on LinkedIn and Twitter.

Veeam’s next big thing

The good ol days

As exciting as IT is now, things were simpler in the old days. You had a bunch of physical servers a tape drive in the corner and some backup software. As long as you remembered to change your tapes you knew everything was being backed up and if you really wanted to go the extra mile you took that tape off site. IT solutions including on-site, public/ private cloud, SAAS mean that data is disparate and the backup situation complex. Whilst there are data protection offerings to meet each individual requirement already, there wasn’t a single vendor with a vision that all the requirements of today’s IT departments. With Veeams next big thing they have come to the table and put forward this complete vision for data protection.

Key Announcements

Lets look at this collection of announcements that form the vision.  The diagram below summarises the proposal that Veeam can be used as a single tool to backup public, private clouds, physical machines and Office365.


VAC final

Office 365 Backup – Arguably the most significant announcement was the integration with Office 365. This new functionality allows the backup of Office 365 data to a Veeam repository. This allows the recovery of individual mailbox items and the eDiscovery of Exchange items.

Agents – Veeam End Point has been available for some time with a suggested use of backup for end user workstations. Veeam have enhanced support for application consistent backups and the Veeam Agent for MS Windows is now supported to protect your physical MS servers. The agent for Linux currently already available in beta, has a similar use case and can also be used for all your physical servers.

It has been a frustration of mine for some time that agents were not available for physical workloads so it good to see that covered off, but more significantly Veeam has stated that these agents can also be used for the backup of VMs that live in the public cloud.

Veeam Availability Console – This is the one console that ties together all the components and again nicely illustrates Veeams vision for a single product to backup and control your companies dispersed data. The availability console comprises the Veeam Availability Suite which is the console most of you are familiar with and probably think of when you think of Veeam. Plus VAC also enables you to manage all your agents from a single console, this was not possible with endpoint. This effectively means you can manage your traditional Veeam snapshot backups, plus physical and cloud backups from a single console.

Further Details

Watch the announcement

Good overview from Anthony Spiteri

Nice summary of all the news by Michael Cade


Staying connected

Stay informed and keep your dataON247 by following on LinkedIn and Twitter plus subscribe to our mailing list.