How to Back Up Business Data and Protect it from Ransomware

Backing up your business data is one of the simplest steps you can take to improve your organisation’s cyber resilience.

Most businesses rely heavily on digital information to operate. This can include emails, documents, invoices, customer information, financial records, presentations, project files and website data.

If that information is lost, damaged or made inaccessible, day-to-day operations can quickly be disrupted.
A reliable business data backup gives you another copy of important information so that it can be recovered when something goes wrong.

Why is backing up business data important?

There are several ways a business can suddenly lose access to important information.
For example:

• Ransomware or malware could make files inaccessible.
• A laptop, phone or other device could be lost or stolen.
• Hardware could fail unexpectedly.
• Files could be accidentally deleted or changed.
• Data could become corrupted.

A problem with a device, application or service can leave your business needing to recover important information. A reliable backup and recovery process helps your business restore that data and resume normal operations.

Backups are particularly important when dealing with ransomware. The UK’s National Cyber Security Centre says backups are an essential part of an organisation’s response and recovery process and that making regular backups is an effective way of recovering from destructive ransomware attacks.

What business data should you back up?

Start by identifying the information your business relies on and would struggle to replace.

Depending on your organisation, this might include:

• Business documents and spreadsheets
• Customer and supplier information
• Financial records and invoices
• Important emails
• Business application data
• Website files and content
• Project files
• Intellectual property
• Operational records

The important question is:
If this information disappeared tomorrow, could your business continue operating?

If the answer is no, you should consider how that information is backed up and, crucially, how it would be recovered.

What are the main ways to back up business data?

Businesses can back up important data to the cloud, physical or on-premises storage, or use a combination of these methods.

Cloud backups

Cloud backup solutions can provide a convenient way to keep copies of business information away from individual computers and devices.

But there is an important distinction to make:
Storing information in the cloud does not automatically make it a secure, ransomware-resistant backup.

The National Cyber Security Centre warns that data backed up on-premises or in the cloud is not resistant to ransomware by default.

Businesses should therefore think about the security of the backup itself, not simply where the information is stored.

Physical and on-premises backups

Businesses can also keep backups using physical or on-premises storage.
The critical point is that a backup should not be unnecessarily exposed to the same compromise that affects your live systems.

For on-premises backups, NCSC guidance on ransomware-resistant backups recommends measures including isolation, restricting access and making it possible to restore an earlier backup if later versions have been corrupted.
Physically disconnected backup media can also make it more difficult for an attacker who has compromised a network to reach backup data.

How do you protect backups from ransomware?

Your business must be able to access and restore its backups when something goes wrong. Ransomware attackers may target those backups, delete or destroy the data, and make recovery more difficult.

When reviewing your business backup strategy, consider:

1. Where your backups are stored
2. Who can access them
3. Who has administrative control
4. Whether backups can be appropriately isolated
5. Whether previous versions can be recovered
6. Whether backup systems are kept secure and updated
7. How significant changes to backup systems are monitored

These measures help reduce the risk that a compromise of your main IT environment also compromises your ability to recover.

Don’t assume cloud storage and backup are the same thing

If your business uses cloud services, don’t assume that saving files to the cloud gives you a complete backup strategy.
Make sure you can restore your critical business data when you need it. You should also protect cloud backups from ransomware and keep recoverable versions available if something goes wrong.

For example, NHS England’s backup guidance highlights recovery, multiple backup locations and regular backups as considerations when applying backup principles to cloud environments.

Your backup strategy should therefore be based on the information your organisation needs to recover, rather than simply whether files exist somewhere online.

Test that you can restore your business data

Making a backup is only part of the process.You also need to be able to recover from it.

Consider testing whether important business information can actually be restored when required.
This becomes particularly important following significant changes to your IT environment, applications or backup arrangements. A backup that exists but cannot provide the information your business needs during an incident offers little reassurance.

Make backups part of your cyber security strategy

Data backup shouldn’t be treated as an isolated IT housekeeping task as it forms part of a much broader approach to cyber security, resilience and secure IT.

A useful starting point is to ask:

• What information does our business need to protect?
• Where is that information backed up?
• Who can access or change our backups?
• Are our backups protected if other systems are compromised?
• Can we successfully restore our important information?

If you can’t confidently answer those questions, it may be time to review your backup and recovery arrangements.

Need help improving your business cyber resilience?

Backups work best as part of a wider approach to secure IT.

Talk to IQ in IT about reviewing your secure IT and cyber security arrangements.