The News: World Backup Day, which has been observed annually for more than a decade as a reminder of the importance of backing up data, was recognized on March 31. While encouraging individuals to back up data on their personal laptops and other devices, there are also implications for IT Operations teams responsible for protecting their organization’s data. Check out the World Backup Day site here for more information.
Analyst Take: World Backup Day has become not only another opportunity to instill the importance of backing up data, but beyond that, it has become an opportunity to instill best practices, which of course continues to grow in importance.
It’s somewhat ironic that World Backup Day immediately follows April Fool’s Day (April 1st), but while any IT organization experiencing a data loss incident might wish it was a practical joke, they often quickly learn that that’s not the case. That’s why World Backup Day and the organization’s mission to bring awareness to the importance of backing up data is so significant.
Data breach incidents have potentially significant repercussions for businesses in terms of cost, downtime, and reputational damage. With the skyrocketing incidence of ransomware, awareness of data loss vectors, and the need for data protection, awareness has reached an all-time high at the C-Suite level. Today, with the influx of cloud and containerized applications and infrastructures that need to be protected and, as data protection becomes a team sport encompassing developers, cloud architects, and security officers,
In addition to our regular engagements with IT Operations teams, our team is having more and more conversations with folks such as Chief Information Security Officers (CISOs), who play a role in both determining data protection requirements and executing the strategy for data protection, as data protection and cyber resiliency become further intertwined.
Based on these conversations, some best practices that jump out as being top-of-mind and which warrant emphasis for IT operations teams and CISOs include the following:
-Shared responsibility is key. The shared responsibility model carries through into the cloud. The customer remains responsible for protecting their data, while the cloud provider is responsible for availability and security of the service itself.
-Don’t forget about containerized environments. Containerized environments, including those using Kubernetes, require protection too. They are moving into production, and thus require persistent storage that is susceptible to all data loss vectors including cyber attacks and accidental user deletion. What’s more, developers require some autonomy with recovery, and require an approach for data protection that is built in and which will not inhibit their agile development cycles.
-Data protection plays a role in attack prevention and detection. Data protection must now play a role in cyber-attack prevention and detection. Strong access control – especially as more visibility and functionality need to be granted to users outside of IT – and analytics and machine learning to uncover indicators of nefarious activity in the backup environment is quickly becoming table stakes.
-Recoverability matters. Recoverability is the name of the game; we are not backing up data for the sake of backing it up. Disaster recovery plans must be documented and vetted. Gone are the days of irregular testing at an insufficient scale, as IT Operations teams face executive-level pressure to prove the ability to withstand a host of disaster events including cyber-attacks.
-The 3-2-1 Rule and data vaulting are critical. Going back to the basics of the 3-2-1 Rule, data vaulting has never been more critical. It’s beginning to look a little different though, as new solutions branch out from physically air-gapped tape storage to include cloud storage, disk solutions, and other technologies. It is critical that these solutions be vetted for security measures, including network and data isolation, and access control.
In conclusion, data protection has become a team sport. IT Operations is still held responsible at the end of the day and remains the center of expertise, but collaboration across the organization is a must for cyber resiliency. This is not easy to accomplish, especially considering the wide range of applications and infrastructures that must be protected, given the ever-growing threat of ransomware and other cyberattacks. World Backup Day is valuable, as it helps shine awareness on the importance of data protection, and presents a perfect opportunity to take stock of evolving requirements and best practices for data protection, roles, and responsibilities of the various individuals involved, and to identify potential gaps that need to be filled. Now we need to move beyond a day that drives awareness and into a security and risk management posture that embraces the importance of data protection and the role it plays in cyber resiliency.
Disclosure: Evaluator Group, wholly owned by The Futurum Group, is a research and analyst firm that engages or has engaged in research, analysis and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article. Analysis and opinions expressed herein are specific to the analyst individually.
