Data Retention and Protection in the Age of Targeted Backups

Hackers target your backups because they know you rely on them to recover from a ransomware attack or other data loss incident. Without your backups, you’re much more likely to pay the ransom. These attacks are happening much more than you may think, with one survey finding that over the previous 12 months, 11 percent of respondents had experienced ransomware attacks daily, and 26 percent had experienced attacks monthly.

You should interpret those data points to mean it’s not a matter of if but when you will suffer an attack. And odds are your backups will be targeted, too. However, balancing security against access, data storage, and protection costs is challenging.

The Vital Role of Data Retention Policies

Responding to these evolving threats demands that you implement strategic data retention policies. These policies protect your sensitive data against unauthorized access or encryption—without breaking your budget. Critical considerations for data classification include:

Data Sensitivity

Not all data is created equal. Your first step in creating data retention policies is determining what data is critical to your business operations versus redundant or obsolete data.

Regulatory Compliance

Your industry, like most, is probably subject to data retention regulations such as GDPR and CCPA. To avoid legal penalties, you must ensure your policies comply with relevant laws and industry requirements.

Cost Control

Keeping data longer can lead to increased storage costs, so a cost-benefit analysis is essential to determine the value of data against the cost of retaining it.

Integrating Your RTOs and RPOs Into Data Retention Policies

Your recovery time objectives (RTOs) and recovery point objectives (RPOs) are critical metrics when developing your data retention policies. These metrics influence your backup and recovery solution choices and are pivotal to your business continuity strategy.

Your RTO is the maximum acceptable length of time your business can be offline. Your RPO is the maximum acceptable amount of data loss your organization can tolerate, measured in time.

Balancing RTO and RPO with data retention policies requires a clear understanding of your business’s priorities, the value of specific data, and the risks associated with data loss and downtime. This will help you prepare for a worst-case scenario and ensure your data can be recovered quickly and efficiently, minimizing disruptions.

Read this post to learn more about RTOs and RPOs.

Best Practices for Secure Data Retention

Consider the following best practices as you develop your data retention policies:

Implement Multilayered Security Strategies

Data resiliency is built on a multilayered data protection strategy. That includes bolstering your data backup storage protections by storing at least one copy in an immutable format, an approach that, as of this writing, still can’t be altered or deleted by AI-driven cyberattacks. You must also implement end-to-end data access controls and execute regular vulnerability assessments.

Update and Test Your Backups Regularly

If your backup and disaster recovery solution doesn’t work when disaster strikes, your business may be toast. Testing is the best way to ensure that never happens. Arcserve Unified Data Protection (UDP) software offers automated testing to ensure your disaster response capabilities are always up to date.

Storage Backups Offsite and Offline

Follow the 3-2-1-1 backup strategy to ensure your backups are always secure. Keep three copies of your data, with two copies in different formats (tape and disk, for example), one copy offsite, and one copy in immutable storage. Air-gapping, where your backups are physically or virtually disconnected from any network, is another highly secure option for ensuring your data can always be recovered.

Train Your Team

With 74 percent of all breaches involving the human element—via social engineering schemes, privilege misuse, stolen credentials, or other means—teaching your team how to spot potentially malicious emails, websites, and other suspicious contacts is crucial. Execute an ongoing cybersecurity training program, test its effectiveness, and share the results with your team to ensure continuous improvement and awareness.

Get the Backup You Need

Arcserve Technology Partners are experts in helping mid-size enterprises implement sound data retention and protection policies and solutions.

Get help now by choosing an Arcserve Technology Partner.

To learn more about Arcserve UDP, request a demo.