Backing up your data is not the most exciting topic-- until you really need it. Once you've
been hit by ransomware, you're going to wish you've done what I'm going to talk about.
There are four different strategies that we could have for doing backups: local backups, cloud-based
backups, air-gapped backups, or immutable backups. There's actually more, but I'm going to summarize
it with those four main approaches and we'll talk about the pros and cons of those and how
they can prepare you so that when the ransomware attacker demands money, you can thumb your nose
at him and go along your merry way. So the first I'll talk about is a local backup. In this case,
I've got my data and I'm just going to copy it to another data source. Maybe it's a USB-attached
drive. It could be network-attached drive, but it's essentially local to my system. And there's
advantages and disadvantages to this. The pros are it's pretty fast because it's a local attachment.
But the downside is it's vulnerable to ransomware. If an attacker comes along and encrypts the main
source-- if they have access to that, because it's locally attached, they probably have access to the
backup as well. And if your backup is encrypted, then it's not going to do you any good at all.
So the next approach then would be a cloud-based backup. In this case, I've got my local data
and I'm going to send it off to some cloud-based storage. I don't really know where it is, I don't
care. But the fact of the matter is, the data is someplace else, so that when this gets encrypted,
as long as I have multiple copies back here, it doesn't automatically encrypt elsewhere. It's
not part of the locally-attached file system, in particular. So I have an advantage here of
disaster recovery. For instance, if my system goes down, if it gets burned up in a fire, if there's
some sort of natural disaster as well, I also have the ability to recover that from the cloud. So
that's a big advantage. Now, there's other things that could be a disadvantage and that's speed. So
it's going to be slower. We've got to go across the Internet in order to get the information. If
you try to recover an entire system that way, you may be waiting hours, maybe days before
you get all of your information back. So that's a problem. Now, yet another approach-- and this is
one I hear a lot of clients talk about --is doing what they refer to as an "air gap". In this case,
there is some sort of breakage between the two. That's what a true air gap is. A lot of
people talk about air gaps, but don't really do them. As long as there is a network connection,
it's not air gapped. Air gap means air. That's the only thing it can be between the
two systems. So they have to be on entirely different networks for that to be the case.
Now, the advantage here is if an attacker does get to this system and encrypts it, it's not going to
encrypt the other because there's no connection. So this copy is still sitting there pristine.
That's an advantage. It's more secure than some of the others I've talked about. What's
the disadvantage? Well, it's not current. Because there's no connection there all the time, whenever
I update my data, then my backup is not also updated, so it falls out of sync pretty quickly.
The fourth approach that I'm going to talk to you about is called an immutable backup.
An immutable backup is one where I can write only one time. So I can take my data and write
it over to the other backup media. And once it's been written, it can't be written again.
So this is what we also sometimes refer to as a WORM drive or a worm system. Write-Once-Read-Many.
So I can read it as many times as I want, but no one can override it. So if the ransomware
attacker comes along and encrypts this source, they can't also encrypt the other because it
can't be overwritten. The advantage here then is it's more secure than some of the other options I
talked about. It also has the advantage of being relatively fast because it's fairly
locally connected. It also has the advantage of not being vulnerable to ransomware, as I
just discussed. Only real downside may be that it doesn't do some of the DR/disaster recovery
type of scenarios because it is co-located. It's near my system. But as many people would say,
two backups equal really just one backup, and one backup is equal to none. You really might
want to use multiples of these strategies so that you're really prepared in case you get attacked.
Thanks for watching. Please remember to Like this video and Subscribe
to this channel so we can continue to bring you content that matters to you.