High-profile ransomware attacks signal it's time for change

On May 7, Baltimore fell victim to a devastating ransomware attack that’s now expected to cost the city $18 million. It's not the first city to be caught in the line of fire. Atlanta was another casualty of ransomware in March 2018; that cleanup has cost upwards of $17 million. These attacks show that the public sector is often unprepared to deal with these kinds of cyber threats. Now, more than ever, it’s necessary for government agencies to reassess their technologies and their ability to achieve IT resilience and protect taxpayers’ money.

Switching mindsets

According to IDC market research, global spending on security hardware, software and services will surpass $103 billion in 2019. That’s a 9.4% increase from the previous year. The research also found that the U.S. is dropping the most cash, tracking to spend $44.7 billion, with the manufacturing industry and the federal government accounting for 20% of it. While it’s encouraging to see that the U.S. is leading the charge in cybersecurity spending and taking cyber threats more seriously, there’s a core part of the equation that’s overlooked, and it’s often what leads to expensive cleanup costs.

Many organizations treat investments in proper data backup and disaster recovery technologies as an afterthought. It’s certainly important to implement technologies that can detect malicious malware, but cybercriminals are quite creative in designing new attacks to hold critical data hostage or to interrupt daily operations. With new methods cropping up every day, cyberattack prevention can only go so far. IT professionals, especially those in the highly targeted public sector, must operate with the mindset that they could soon fall victim to an attack. They must make the adequate investments in data storage and disaster recovery technologies, too. 

Ensure redundancy with multiple recovery locations

One key element that’s often missed in cyber threat mitigation and disaster recovery planning is the need to ensure data redundancy with multiple recovery locations. There are two basic approaches IT managers can take to make sure they can recover their backups in case of a ransomware attack.

1. Enabling on-site and off-site recovery. A hybrid approach to data backup and disaster recovery can be an effective way of ensuring IT teams can recover data when a malicious actor takes it hostage. In addition to having a local copy on-premises, IT teams can back up data to a public or private cloud. It’s also important they pay special attention to the IT architecture so backups are not infected by the original attack. Backups can be protected by having them on a separate domain and always turning encryption on.

Organization that opt for a hybrid model must closely read the terms and conditions of different subscriptions, as many public cloud services often charge fees for moving, accessing or restoring data. Being unaware of these fees can easily blow IT budgets out of the water, so it’s important agencies  strategically tier data in terms of criticality to determine what should be stored where for swift recovery.

2. Multicloud backup and recovery. Another option is to take a multicloud approach to backup and recovery. Many organizations are starting to implement a strategy to enable cloud-to-cloud recovery and failover, too. However, like a hybrid approach, this must be carefully planned and executed to keep spending in check.

Public-sector organizations considering such an approach should create a representative body that can address both technical needs and financial concerns. Many organizations run into problems when they start deploying multiple clouds without considering what they’re actually using them for. If they don’t pay attention, they can end up managing several different technologies and vendors that not only lead to expensive fees, but also to an increased risk of data loss.

Don’t skimp on advanced technologies

Aside from considering where they’re going to store and recover critical data, IT teams must be confident they’ve selected a disaster recovery solution that’s going to meet the recovery speeds they need, as well. So, what should they be looking for?

First, it’s important the team consider what kind of files, systems and applications the technology supports and where they can backup and recover workloads and applications. Some vendors specialize in cloud backup and recovery, while others take a broader approach and support the complex and multigenerational IT environments often found in the public sector. Look for vendors that are able to support most, if not all, applications and systems to reduce the number of technologies the IT team manages.

Further, it’s critical IT teams evaluate how fast the technologies can recover information. Most public-sector organizations can manage if their technologies allow them to recover critical data within a few minutes. But for some, that might not be fast enough. That’s why teams should know how data is being replicated so they can understand what their recovery capabilities really are.

Many technologies use a snapshot-based backup process, which is a good approach for achieving recovery point and recovery time objectives within minutes. However, there are also other technologies available that employ what’s called a journal-based approach to data replication. This creates continuous data replication and automatic failover, enabling seamless recovery that’s almost undetectable to end users. Continuous replication technologies can also allow IT professionals to go back to predetermined points to recover data, which is especially helpful in cases of data corruption or loss.

Ransomware will to continue to be problematic for the public sector, especially for smaller, local government agencies. Now is the time for these organizations to assess where they’re storing their data, how they’re going to recover that data and what technologies they have in their arsenal to do so effectively.

Disaster recovery can no longer take a backseat. The attacks on Atlanta, and now Baltimore, have shown us the cost of recuperation is far too high, especially for the taxpayer.