Foresight 2020: Create an offline backup

With the amount of ransomware going around in the state, it would be crazy not to consider some type of backup. Whether it is online or offline, a backup is essential in today's security environment. If your company's cybersecurity team is not implementing and testing their backups regularly, you are in for a world of trouble! Usually, when talking about Information Technology, a backup is a copy of data that can be taken or stored elsewhere. Having a backup is a good security practice as it helps in putting the same information in different places for things like disaster recovery and business continuity.

Backups can also be used in the case of a hack or data corruption.   There are several small businesses that never take backups of their data.  In one such case, a small healthcare business that had no backup, was hit by a ransomware attack.  They had to use their limited paper records and phone call logs to painstakingly recreate their customer database.  This process took months and business was severely impacted. 

What is an Offline backup?

An offline backup (also known as a local backup), is any backup done by the entity with some sort of physical device. What I mean by a physical device is a USB, Hard Disk Drive, NAS, CDs, etc...

Pros:

1. Low Cost: Typically, a flash drive, a spinning drive, or any mass storage device is relatively cheap. You can store terabytes of backed up data to these devices and take it anywhere as well. It can support a small business.
2. Portability: Having a flash drive with you in your bag or briefcase is convenient when you need it on demand. You can plug it right into your computer. You can easily have a device store terabyte of data in your pocket.
3. Safety: As mentioned earlier, ransomware is malware that is plaguing and crippling businesses. An offline backup can prevent that since the data is not tied to the network. Your offline backups can be disconnected entirely from the network, and this limits the possibilities for a hacker or malware to infect it.   Ideally, the offline backup should consist of data only, not software, so that malware is not accidentally copied to the backup device.

Cons:

1. Can easily be corrupted: The considerable downside to any physical device is the fact that data is corruptible. Meaning the data will no longer be usable. Corruption can happen in many ways: Sudden loss of power, lousy program exits, or any error in the standard computer process.
2. Theft: Any physical device is susceptible to theft. It can be taken from your briefcase, car, or even business building. Mass storage devices, although they are not extremely expensive, are still worth something and still worth taking. Since offline backups are not typically encrypted, they have a very high risk of data theft.
3. Damage: Have you ever sat at your desk, and you accidentally spilled coffee all over your table and yourself? Well, that easily could have fried your hard drive or other backup device, meaning any data stored on that device will be unusable. It can also be an angry employee who decides to take a hammer to work and take out his frustrations on the servers. You never know.

What is an Online Backup?

An online backup is a copy of data that is being stored on the internet—also known as cloud storage. Online backups have become extremely popular and very common on just about any device. A cloud backup would be done by a 3rd party vendor where they will store your data on their devices with their security and measures in place. It is an excellent choice for small or big business as it allows for easy expandability.

Pros:

1. Virtual Access: The great thing about virtual access is the fact that you can access your data from anywhere that might have some internet connection. Let's say you go to a customer's building, and you forgot the flash drive with the presentation on it. If you have an online backup, it can easily be retrieved.
2. Little Chance of Corruption: Since the data is backed up to an external company whose primary business is to protect your data, the chances of data corruption are lower. There is still a chance of corruption or some data loss, but it is far less likely. 

Cons:

1. Less Control over your data: Since the data will be sent to a vendor, they are responsible for keeping that information safe and private.  
2. Internet Connection: Information can only be accessed when an internet connection is available. If the internet connection were to go down, any online resources would be cut off, including any data stored on the cloud. Making it one point of failure.
3. Not On-Demand: Any large files that you are trying to get from this vendor would take a lot longer than if you had a local copy of it. Uploading and downloading large chunks of data could take a significant amount of time.
4. Vulnerable to cyber crime:  An online backup is vulnerable to being locked or encrypted by a ransomware attack.  This happened in several companies who were hit by the WannaCry ransomware in 2017, and they could not recover their data easily without paying ransom.
   
   

Final Thoughts

My final thoughts are that if any company wants to start taking their cybersecurity team seriously, they need to allocate a budget for both offline and online backups. Every organization should have a data backup strategy.  As of right now, online backups are not entirely foolproof. Our lives have become so dependent on technology that a company's network and its data are among its most critical assets.  An offline backup will minimize the impact of a successful ransomware attack. Rather than being reliant on cybercriminals giving you your data back, you’ll be able to recover your data and systems.  For maximum security, take periodic offline backups.  These backups should be stored in a separate location from your main office for redundancy.  The frequency of these backups will depend on your business needs