Data Safeguarding

This chapter is about backups. I know it sounds so boring. A chapter about backups, really? Yes, because good offline backups are paramount to securing your company’s data, ensuring your company’s data and computers are available, and keeping your company running. We will be discussing the importance of backups, testing your backups, and business continuity.

In this chapter, we’re going to cover the following main topics:

• Offline backups
• Testing your backups
• Availability in the cloud
• Business continuity
• Disaster recovery

Offline backups

I was at a security conference, and I heard a talk by Sean McCloskey, the Chief of Cybersecurity for the Cybersecurity and Infrastructure Security Agency (CISA) Region 4. Sean spoke about the importance of good offline backups. He said that every single company that has suffered a ransomware attack where he was part of the incident response did not have good offline backups. Whenever I talk about backups, I always stress that they must be offline. You’re probably asking, What’s the deal with offline backups? Well, with ransomware, it will encrypt all connected online drives. If you are using iCloud or SharePoint as an online backup drive, it will also be encrypted if ransomware is run on your computer. Likewise, any online USB-connected drives will be encrypted.

It’s paramount that you have good offline backups. The way to do this is to configure incremental backups and disconnect access to the drive in between. Windows has a built-in incremental...

Testing your backups

When I was a CISO at RedSeal, the Chief Executive Officer (CEO) came back from a training session with a Venture Capital firm. It was a security and leadership conference for all of the CEOs in the Venture Capital Company’s ecosystem. The CEO immediately reached out to me with the top actions that our company needed to take in order to be protected against ransomware. I had already done a lot of research on ransomware for a presentation that I did at the Healthcare Information and Management Systems Society (HIMSS) Conference, which is one of the largest IT Health conferences in the world.

Having good offline backups, as well as testing your backups, was a must. Many times, when it comes to being time to recover from a backup, the company realizes too late that they either don’t have good offline backups or their backups are corrupted in some way. Possibly, the data they thought were being backed up weren’t.

The best way to prepare for...

Cryptographic hashing

While we are talking about hashing, I wanted to explain what it is and why you want to use it. Ensure your company is using SHA-256 or above. SHA-1 has been deprecated due to a SHA-1 collision. A SHA-1 collision occurs when two distinct pieces of data hash to the same message digest. If an attacker can craft a collision, they can use it to create two different files that share the same SHA-1 hash value1.

1 Stevens , Marc, and Elie Bursztein. Announcing the First Sha1 Collision. Google Online Security Blog, Google, 23 Feb. 2017, security.googleblog.com/2017/02/announcing-first-sha1-collision.html.

Although SHA-1 has been deprecated, hmac-sha-1 is still okay to use since it is a secret keyed hash value. What a hashing algorithm provides is integrity. It doesn’t actually encrypt the data, so you can’t read them. Hashing runs a mathematical function on the document that essentially fingerprints it. If anything in the document changes...

Availability in the cloud

One of the great things about the cloud is that availability is built in. All of the cloud services provide this. Amazon’s relational database service (RDS) automatically backs up your database instance to Amazon S3 for the duration that you specify. Additionally, you have the option to manually create snapshots, which are retained until you choose to remove them. The snapshots are the same as full backups. In addition, in AWS, they have regions, and within each region, there are availability zones. There is built-in availability with automatic failover within the regions. This is a great cost savings for cloud-first startups. They can use these built-in availability cloud features and not have to purchase an additional backup-as-a-service.

The other thing to think about is that each SaaS service that you use provides automatic backups of the data within their service. For example, SalesForce provides at least 30 days of backups. For small- and medium...

Business continuity

Business continuity is keeping your business running in the event of an incident. We’ve all heard of the nightmare ransomware attacks where companies have to literally stop work until they are able to stop and recover from the attack. Your business continuity plan covers the roles and responsibilities of the individuals involved as well as a line of succession or who will be contacted and in what order. The business continuity plan is typically more general in that you don’t list people’s names but their job titles. For example, under the line of succession section of the plan, it can be said that the CEO is responsible for the safety and security of the employees and will ensure the business continuity plan is followed during a disruption. Next, there might be a description of the Head of Engineering being responsible for recovering the IT infrastructure in the event of disruption. Additionally, explain what happens if the CEO is unavailable...

Disaster recovery

Disaster recovery is extremely important to keep your company running in case of a disaster. It can be a natural disaster such as a flood, earthquake, or hurricane. It could also be man-made, such as a ransomware attack, that brings your company to a halt. Before the cloud, you had to have a secondary data center from your primary one that had a hot, warm, or cold setup. The secondary site would be in another region. For example, if your primary site was on the East Coast, then your secondary backup site would be in the Central time zone. Ideally, a disaster recovery site is located in a geographically separate region, far enough from the original site to not be affected by the same disaster (such as a flood or earthquake) but close enough to be reached in a timely manner if physical access is needed. The choice between a hot, warm, or cold site is a balance between cost, speed of recovery, and the importance of the systems that are being protected.

Hot site: A...

Summary

In summary, good backups, availability, business continuity, and disaster recovery are imperative to ensure that your company can maintain operations in the event of a disaster. Whether a natural disaster, terrorist attack, or man-made disaster occurs, your company will be prepared with thoroughly tested business continuity and disaster recovery plans.

In the next chapter, we will be covering security awareness training. When building a security program, ensuring you build a culture of security awareness is important. You can have excellent security safeguards, but one click on the wrong link or having a hacker trying to tailgate could open your company to attack.