Immutable Backups and The Public Cloud – Part I

In this two-part series on public cloud security, data center industry insider Klaus Haller details the importance of immutable backups in the cloud migration process for enterprises.

Klaus Haller, Freelance Contributor

December 28, 2022

4 Min Read
Keyboard image of the public cloud.
Dima / Alamy

Immutable backups sound like a niche nerd topic, but somehow CEOs, boards of directors, and risk and audit specialists suddenly get interested. They are nervous – but why? What is the threat, and how do immutable backups help? And how can IT organizations turn such an idea into a technical reality if running 100% of their workload in the public cloud? 

New Threats on the Rise 

Ryuk, NotPetya, and the Russian cyberattacks on Ukraine before the invasion are a Pear-Harbor-like wakeup call for CIOs and CISOs. The Ryuk ransomware aims to infiltrate IT infrastructures to encrypt critical company data. Then, they “offer” help to decrypt the data after a ransom payment. They ask for a six-digit payment, not for millions – a sum a typical SME or organization can pay, be it a hospital, a school, or a governmental agency. That is the first threat on the rise. The second relates to state-sponsored destructive cyberattacks, with the 2017 NotPetya attack being a prominent example. It encrypts the victims’ data without anyone (including the attackers) being able to decrypt it. While Ukraine companies were the primary targets, it spread worldwide. Thus, the first learning of NotPetya is: system-relevant companies and organizations such as electricity companies, power plants, or oil and gas pipelines are prime targets for destructive state-sponsored attacks. Second, there is collateral damage. Why would an attacker invest in sophisticated algorithms to narrow an attack to hit only electricity companies when they can damage other companies in a targeted country, even with less engineering effort? Becoming collateral damage of state-level cyberconflicts and cyberattacks is a real threat today.  

Related:Oracle Cloud Earnings Gains Pit It Against AWS, Azure, Google

A Typology of the New Cyber Threats 

The characteristics of today’s cyberattacks get apparent when comparing them with a long-ago global malware incident. Experienced IT managers might remember early May 2000. These were the days when many employees got love emails at work. However, you should get suspicious when the secretary, your boss, and the CEO write you an “I love you” email shortly before the mail servers crash. A worm programmed in Visual Basic took the world by storm. It replicated by sending itself as an email attachment to all Outlook contacts of a victim besides performing some destructive actions on the workplace computer. Today’s attacks, such as Ryuk or NotPetya, are different and more dangerous: 

  • ILOVEYOU targeted workplace computers. They are, besides mobile devices, just an entrance door for attackers today; servers are the jackpot.  

  • ILOVEYOU was easy to detect. Surprising emails, crashing servers – admins had to get active. In contrast, companies today still do not detect 20% of compromises within the first seven days (SANS Incident Report 2019).  

  • The ILOVEYOU damage was neither systematic nor did the worm try to do maximal harm. In contrast, today’s attackers analyze the victim’s IT infrastructure and try to take over admin roles to maximize damage.  

With this changing threat landscape, companies might want to reassess how likely devastating attacks are. Attackers do not have to delete all databases to bring a company down. What happens with a bank if cyber-gangsters encrypt “only” the databases required for the authentication component of online banking together with the customer names and address database? Can an industry company survive if the inventory management and the supply chain database are encrypted? Once companies rate such a risk as not-acceptable and start looking for mitigation options, (immutable) backups are no longer a niche technology but a board-of-directors topic. 

Backup Use Cases: Four Oldies and One Newbie  

Backup solutions saw as much innovation and action in the last decade as cemeteries on a rainy November night at midnight. But now, the rise of public clouds as backup storage (not here in focus), sophisticated cyberattacks, and the hope and need for immutable backups in the cloud mix up the scene.  

The classic backup solutions cover four prominent use cases:  

  • Device Failure: Technical components fail, e.g., a hard disk crashes, and there is no way to restore the data from this disk.  

  • Operational Failures: An engineer deletes a critical database, a VM, a file share, or any other system or storage solution by mistake.  

  • Critical Operations Safeguard: An engineer plans a risky change, e.g., deploying a patch or reconfiguring a database schema. Before applying the change, he makes a copy. If there is any issue with the change, he restores the previous situation from the backup.  

  • Site Failure: A company’s data center with all servers becomes unavailable, e.g., because it burns down.  

The new use case for immutable backups is:  

  • Cyberattack Restoration: The ability to reconstruct a working state of all applications and their data after a cyberattack has taken over admin accounts and deleted or encrypted critical resources. 

The main difference between classic backup use cases and the immutable backup for cyberattack restoration is the ability to “survive” with an attacker having the highest admin privileges. When in the public cloud, companies cannot place appliances and storage systems in a data center and manage them with local user rights and an emergency keyboard. You also cannot use backup robots that write your data on tape. In the cloud, an admin can do (nearly) everything. Thus, companies need new backup concepts.  

In part II of this two-part series, Klaus Haller examines implementation of and alternatives to immutable backups in the public cloud.

About the Author(s)

Klaus Haller

Freelance Contributor, Data Center Knowledge

My passions are Cloud Security, AI, and Digital Transformation. In the daytime, I work as a Senior IT Security Architect. My areas of expertise span public clouds (Google Cloud Platform and Microsoft Azure) and how to secure them, technical project and project management, IT operations, and information management, analytics, and artificial intelligence.

Plus, I am a tech author working on articles in the early mornings or late evenings, reflecting and sharing my work experience. But most of all, I enjoy presenting and discussing with colleagues at conferences and workshops!

Order my book – "Managing AI in the Enterprise" – with Springer or Amazon, and become an even better AI line or project manager!

Subscribe to the Data Center Knowledge Newsletter
Get analysis and expert insight on the latest in data center business and technology delivered to your inbox daily.

You May Also Like