Cyber recovery: Surviving a digital extinction event

Today’s cyber threats often require more sophisticated defences than most traditional disaster recovery plans can deliver. A cyber recovery vault can help keep data safe, even in the face of malware

Imagine getting a call at 4 a.m. with the news that a cyberattack has knocked out nearly your entire network. What do you do next?

It’s a true story, and perhaps the most shocking part is the speed with which the attack happened. The year was 2017, and the NotPetya virus was the culprit. Once the malware reached this company’s network, it took just two seconds to hit the first machine and 90 minutes to lock nearly every server and endpoint globally – 4,000 servers, 45,000 PCs, and 2,500 applications.

Of particular note is that this was not a targeted attack aimed at this specific company; the virus was actually created with another target in mind. Once it made its way onto the public internet, the collateral damage was significant. “You don’t have to be highprofile to be a victim of this kind of attack,” said Kieran Norton, a principal with Deloitte.

In a recent Dbriefs webinar, Norton and other Deloitte leaders discussed the evolving nature of today’s cyberattacks and what companies can do to maximise their resilience.

A New Focus on Data Integrity

With technology embedded throughout so much of the world, there’s been an exponential expansion in the attack surface available to bad actors. “If it has an IP address, it is a potential vulnerability,” said Pete Renneker, a managing director with Deloitte.

Meanwhile, even as companies scramble to secure their technology, the types of attacks being perpetrated are changing rapidly. “As we design and implement new controls, there’s somebody on the other end trying to find ways to circumvent those controls,” Renneker noted.

While many attacks used to focus on data theft, the emphasis has shifted to data integrity, making that the top cyber concern for respondents to Deloitte’s 2019 Future of Cyber Survey. Loss of revenue due to operational disruption is now the biggest perceived impact of today’s cyberattacks, the survey found.

‘Weeks or Months’

Disaster recovery architectures often rely on backup and replication tools, which may propagate the infection to redundant systems and storage. Recognising the business world’s reliance on these tools, some bad actors are specifically targeting them to maximise the destructive impact. In addition, traditional business continuity plans, which typically detail the manual workarounds that can help sustain temporarily disrupted operations, are often illequipped for sustaining digital business processes where manual workarounds may be impossible.

“Ultimately, because of this backup architecture, your systems and data may be lost in a matter of minutes,” Renneker said. “The more critical the system, the more aggressive the redundancy, the higher the likelihood that malware will move quickly through the environment.”

The resulting downtime can be significant. “Physical and traditional outages are often measured in hours and days; destructive malware attacks are typically measured in weeks or months,” said Michael Juergens, a principal with Deloitte. “It can turn into an extinction-level event.”

The Cyber Recovery Vault

Cyber resilience in the face of today’s modern threats typically requires capabilities beyond those included in most traditional recovery and continuity programs. For many companies, it’s time to modernise existing risk management programs for improved readiness, response, and recovery capabilities. A cyber recovery vault can play an important role.

Built off the storage array, a cyber recovery vault takes essential backups and business data and stores them in segregated, secured, and immutable form. Although malware may still find its way into the vault, the technology’s design protects data from destruction. “The data sits in the vault in essentially a cryogenically frozen state,” Renneker explained. “While the malware may be there, it is unable to deliver its payload.”

Once the organisation has identified and examined the malware in question, it can then extract, inspect, cleanse, and recertify exposed data and applications, thus accelerating recovery of critical business operations.

Core Components

Elements that typically go into the cyber recovery vault include core infrastructure services such as Active Directory, network configurations, backup catalogues, Domain Name System (DNS), and more, along with any other essential business data and services.

Once inside the vault, data is segregated by an air gap, limiting lateral movement; secured by physical and logical protection; and made immutable to protect against permanent deletion or destruction. Data-integrity checking on the vault itself can accelerate malware discovery, further increasing the value and utility of the solution.

Core components of a cyber recovery vault typically include:

• Storage vault – the physical or virtual storage area for the backup data and other critical materials.

• Data recovery zone – used to reconstruct environments from the vault.

• Clean room – a setting to certify that recovered environments meet security standards and are safe for promotion back into the production network.

• Workflows – preconfigured to automate data transfer, forensics, damage assessment, and application triage activities. • Playbooks – steps to orchestrate recovery while avoiding an inadvertent secondary corruption.

Initial Steps

While traditional disaster recovery systems are often based on a “more is better” mindset in which as many systems as possible are deemed critical and included in backup plans, cyber recovery takes a more selective approach. Rather than aiming for recovery to business as usual, the focus shifts to achieving a new minimum viable “normal” for operations to enable organisational survival.

Enterprises aiming to embrace the cyber recovery approach can begin with a few key steps:

• Assess business survival needs while implementing a critical materials vault. Accelerate protection of foundational systems, drive awareness of the risk across the business, and identify critical business functions.

• Map “heartbeat” business services. Map services from critical business functions to underlying applications, data, and infrastructure and define a minimum viable business operating environment. • Develop application, data, and infrastructure dependency maps. Identify interdependencies to establish a minimum viable technical operating environment. • Complete vault build-out. Design and implement remaining core components including the data recovery zone, clean room, and workflows.

• Develop service recovery playbooks and ongoing governance. Document baremetal recovery processes and conduct tests to verify the solutions work as designed. Incorporate ongoing management into a cyber resilience framework.

• Perhaps most important is taking the first step. “Avoid the trap of overanalysing or stalling,” Renneker said. “This is an area where quick wins can pay big dividends.”

There’s no end in sight to the cyber threats on the horizon, and many companies are not adequately prepared. By taking some critical, proactive steps today, they can help pave a solid path to the future.