A medium-sized napkin manufacturer from Euskirchen recently had to file for bankruptcy after a cyber attack led to three days of production downtime and three weeks of restricted operations. The company had only three months to deal with the millions in damages.
This example shows that it is not only large corporations or critical infrastructure companies that need to worry about their cyber resilience. The threat of attacks that could threaten their very existence affects companies of all sizes. Awareness of these threats has increased significantly in recent years. Companies now invest almost 20 per cent of their IT budgets in cyber security. Nevertheless, ransomware and malware remain the most common forms of attack. When primary security measures fail, a reliable backup system is the last line of defence. Today's backup tools offer more than just simple backup copies of files in secure storage. This basic functionality for restoring corrupted files has been consistently expanded in recent years.
Backup is more than just backup
Modern backup infrastructures strengthen corporate resilience even before the actual backup process. They work with zero trust network structures and use information from security tools to improve the resilience of the overall system. But even during the backup process, more and more attention is being paid to data flows in the backup. Transport Layer Security (TLS) encryption is now standard. In addition, the systems use entropy measurements to analyse the data during the backup in order to identify potentially compromised content. Such measurements are statistical methods for predicting usable data content that can detect altered data.
In addition, the data is indexed for threat hunting. Current YARA rules, file patterns and hashes are used to check the quality of the backed-up data. These results can be used to identify exact recovery points for ‘clean’ restores. So-called clean rooms are used to check the recoverability. In the past, these restore tests were limited to individual virtual machines – today, many of the new solutions allow for related tests to be performed on an application basis. With the help of these techniques, current backup tools offer accurate predictions of the recovery time objective (RTO) and recovery point objective (RPO) as well as data quality. We are currently seeing how artificial intelligence is continuously improving these analyses.
Indispensable and strategically important component of modern security architectures
Backup systems are now an indispensable and strategically important component of modern security architectures and make a decisive contribution to cyber resilience – provided that companies consistently use the analysis and insight capabilities they offer.
While management often used to view backups as an unpopular ‘cost drain,’ this view has now changed. Under the banner of business continuity and risk management, they are now considered a fundamental pillar of the availability and security of company data.
This article appeared in IT Security, issue 04/2025.
