Data security has been a much-talked-about issue these days as cyberattacks are becoming rampant. Just last month, Goldheart, which is a part of the Aspial Lifestyle 5UF group, reported that its e-commerce website was breached by an external party that targeted the site specifically.
A day later, watch retailer Cortina C41 Holdings announced that it had been subjected to a “sophisticated cyberattack” where an unknown party gained unauthorised access to the group’s servers and encrypted the information. More recently in late June, EY and PwC, two of the big four accounting firms, were also affected by a cyberattack on the MOVEit file transfer tool.
These instances are in line with Veeam’s 2023 Data Protection Trends report, which reveals that 85% of the organisations surveyed suffered from at least one cyberattack in the past 12 months. “Cyber crime knows no geographical boundaries. But we see a lot of ransomware and malicious activity targeted towards financial institutions and healthcare organisations, as well as those most willing to pay a ransom,” shares Veeam’s chief technology officer Danny Allan during an interview with DigitalEdge at VeeamON 2023 in Miami.
While organisations are more aware of cyber threats, especially ransomware, most are not doing enough to protect their data. Allan says: “Compared to three years ago, organisations are certainly much more aware of ransomware, but many are not taking the right action like making backup immutable. Perhaps they’re unwilling to pay more money to do so as there’s cost associated with immutability.”
A cloudy situation
The situation is similar in the Asia Pacific and Japan (APJ) region, with Veeam’s report revealing that 79% of the organisations have a gap between how much data they can afford to lose after an outage versus how frequently data is backed up.
See also: Keys to achieving human-centred automation testing
“The reality is that there’s always going to be a gap. Business and IT leaders need to be in sync, so they need to talk about how much data loss and how long a downtime they can afford [before they can make the right moves to come to a middleground],” says Veeam’s APJ lead Beni Sia.
Ensuring data mobility is another challenge organisations face as they embrace hybrid cloud, notes Anthony Spiteri, Veeam’s regional chief technology officer for APJ.
“I think we’ve reached a point where organisations realise they will not put everything in the cloud [to be more agile or compliant]. So data needs to be portable — it must be able to move to the cloud, between clouds and also from cloud to on-premises (also known as repatriation) to be more agile. This is why we want to help organisations not only back up their data and protect it, but also ensure they can always access that data and move to whenever it’s needed,” he says.
See also: Human element still important for effective mass communication
Agreeing with him, Sia adds: “I think having the freedom to move data as needed really resonates with a lot of our customers. One day, business and regulatory requirements may change such that they require data to be stored in a certain environment. So having this data mobility or portability helps organisations future-proof themselves.”
Is cyber insurance a necessity?
Since it may be inevitable to fully prevent cyberattacks, organisations are adding an extra layer of protection by turning to cyber insurance. However, cyber insurance is becoming increasingly expensive. According to Veeam’s 2023 Ransomware Trends Report, organisations that renewed their cyber insurance saw higher premiums (74%), increased deductibles (43%) and reduced coverage benefits (10%), as compared to their previous policies. Moreover, 21% of the respondents stated that ransomware is now specifically excluded from their policies.
“I’m hearing from a lot of partners in Australia that more and more cyber insurance claims are getting rejected as part of the requirement is to conduct monthly restoration testing. As such, we’ve equipped our partners with security assessment tools so they can help customers do regular restoration testing. We also conduct quarterly security assessments for our direct customers to ensure they have an optimal backup environment and that their backup data is not [infected by malware],” says Belinda Jurisic, Veeam’s vice president of channels, cloud and service provider for APJ.
Meanwhile, Sia believes that organisations should not be overly reliant on cyber insurance. “They may need some form of insurance so that their business won’t hit rock-bottom in the monetary aspect when they are hit by ransomware. But if you protect your data well such as following the 3-2-1-1-0 backup rule, you may not need cyber insurance as you’re able to recover well and quickly,” he explains. The rule recommends three copies of data to be stored on two different media, with one copy at an off-site location and another being offline, air-gapped or immutable. Backups must also be verified without errors.
The need to make data immutable
Veeam’s 2023 Ransomware Trends Report also reveals that cyber criminals today attempt to attack the backup repositories, in which they remove the option of recovery to force victims to pay the ransom. Many of those attempts have been successful, with 75% of organisations losing at least some of their backup repositories during the attack.
To stay ahead of the latest tech trends, click here for DigitalEdge Section
The key tactic to counter that is to focus on immutability so that the backup repositories cannot be deleted or corrupted. For instance, YTL PowerSeraya — an electricity producer in Singapore that was spun off from Singapore Power — has deployed Veeam’s solutions to improve its disaster recovery and data protection capabilities.
“We have decommissioned all our old tape libraries, and our data protection process is now far faster and more efficient. Using Veeam, we can recover individual files or even entire virtual machines within minutes. Crucially, Veeam creates immutable copies of data that cannot be changed after they are created. With the ransomware threat growing all the time, the capabilities we’ve gained give us great peace of mind,” says Fu Xiao Hua, head of Technology Group of YTL PowerSeraya.
To help more organisations ensure their data is immutable, Veeam provides guidance on its Veeam Data Platform. “When our customers don’t have an immutable copy of their data, or if they’re not following best practices, our latest platform will notify them that they’re not doing [a particular step correctly],” says Allan. He also shares that the platform offers a cost calculator to introduce a level of transparency in terms of helping organisations understand what they are paying for.
