The Digital Operational Resilience Act (DORA) marks a new phase in how financial institutions must approach cybersecurity and operational resilience. With its January 2025 implementation date fast approaching, institutions are focusing on aligning their ICT (information and communication technology) risk management frameworks with DORA’s stringent requirements.

One critical aspect of compliance under DORA is ensuring that institutions have robust backup policies and procedures in place. This article discusses how backup solutions, particularly cloud-based ones, can help financial institutions meet DORA compliance requirements, ensuring minimal downtime and protecting the integrity of their operations.  

Unpacking DORA’s backup requirements 

DORA mandates that financial institutions incorporate comprehensive backup, restoration, and recovery measures into their ICT risk management strategies. These backup systems are not simply a technical requirement — they play a central role in ensuring business continuity. DORA stipulates that backup solutions must be:

• Secure: Protect the confidentiality, integrity, and availability of data. 
• Activated without compromising IT systems: Backup procedures should not expose systems to further vulnerabilities during restoration processes.

In practical terms, financial institutions must set up backup systems that can withstand cyber incidents, system failures, and disruptions. Crucially, DORA emphasizes that backup is not just an IT issue — it is a governance issue, requiring oversight and approval from executive management. Backup solutions must, therefore, be part of the organization’s strategic ICT risk framework. 

The role of backup solutions in DORA compliance 

Effective backup policies and procedures lie at the heart of operational resilience and DORA compliance. In line with internationally recognized standards like ISO 22301 (business continuity) and ISO 27031 (ICT disaster recovery), backup solutions are indispensable for preparing for and recovering from disruptive incidents.

DORA’s focus extends beyond simple data restoration. It includes ensuring logical and physical data segregation (air gapping), data encryption standard, access control, data integrity, and redundancy. Financial institutions need to select backup solutions that ensure the following: 

• Redundancy and high availability: Ensures continuity by replicating data across multiple locations. 
• Strong encryption and access control: Secures data both at rest and in transit. 
• Quick recovery times: Minimizes downtime during an incident response by swiftly restoring access to critical systems and data.

Choosing a third-party backup provider with a proven track record in financial services can help ensure compliance, while also mitigating risks in the event of an incident. 

Regular testing: A pillar of effective backup practices 

Under DORA, regular testing of backup and restoration procedures is mandatory. This ensures that institutions can quickly recover in the face of incidents, while also identifying gaps in their current strategies. These tests must be conducted periodically, with large organizations often needing to implement threat-led penetration testing (TLPT).

However, not all backup solutions offer equal efficiency when it comes to testing and auditing. When choosing a vendor, it is important to look for those that support: 

• Efficient auditing and reporting: Documenting the effectiveness of backup processes without using excessive business resources. 
• Frequent and flexible testing capabilities: Allowing businesses to test their backup infrastructure as often as necessary to ensure compliance with DORA’s stringent requirements.

As backup testing will be a recurring event under DORA, the ability to perform these tests without disrupting normal business operations will be critical for maintaining both operational resilience and regulatory compliance.

Conclusion 

Backup solutions are central to meeting DORA’s ICT risk management and operational resilience requirements. Financial institutions that invest in robust backup systems can protect their operations from disruptions, ensure continuity, and, most importantly, comply with the regulatory demands set out by DORA.

In summary, when selecting backup solutions, financial institutions should focus on key features that will ensure they can meet DORA’s stringent requirements: 

• Access control and encryption: Protect data integrity and confidentiality with data encryption standard. 
• Redundancy and high availability: Ensure that data is consistently available when needed. 
• Efficient testing and reporting: Minimize resource use while meeting regulatory testing mandates. 
• Comprehensive recovery plans: Ensure a quick and organized restoration of services after an incident. 
• Detailed documentation: Maintain thorough records of backup processes, testing, and recovery, crucial for both internal governance and external regulatory audits.

By implementing these strategies, financial institutions will not only achieve compliance with DORA but also enhance their resilience against cyberthreats, securing their operations and maintaining the trust of their customers. 

From insurance to defense: Creating a cybersecurity framework for ransomware resilience 

As organizations continue to adapt to an increasingly digital world, the risks we face from cyberattacks grow more complex and, unfortunately, more frequent. The rise of ransomware (and ransom payments) has become a significant threat to organizations of all sizes, demanding more robust defenses and comprehensive strategies to mitigate the associated risks.

Cyber insurance has emerged as one key tool in this fight, but it’s only part of a larger, multifaceted approach to cyber resilience. In this blog, I’ll explore the critical role of cyber insurance, alongside essential cybersecurity strategies, and how building your cybersecurity maturity framework — based on the controls required by insurers — helps ensure resilience.

The growing ransomware threat

Ransomware has evolved from opportunistic attacks to a sophisticated, well-organized criminal enterprise. According to ESG research, 89% of enterprises consider ransomware one of the top five threats to their business viability. This figure is alarming but not surprising. Surprisingly, 11% of organizations still don’t see ransomware as a top threat, despite its rapid growth and severity.\

Serious incidents, like ransomware, are no longer a question of “if” but “when.” Attackers continually refine their methods, targeting vulnerable organizations by exploiting gaps in security and even indirectly attacking through trusted third parties. As organizations expand their digital operations, they increase their exposure to these threats.

Many organizations assume they’re too small or insignificant to be targeted, but that assumption can be a dangerous one. Even companies that aren’t directly targeted are at risk. Cybercriminals no longer discriminate based on size or industry; they look for weaknesses and exploit them wherever they find them. Ransomware as a service (RaaS) has lowered the barrier to entry so much that even those lacking technical skills can “pay to play.” Read our blog about RaaS.

Understanding cyber insurance in a ransomware landscape

While cyber insurance can provide financial protection against the fallout of ransomware, it’s important to understand that it’s not a silver bullet. Insurance alone won’t save your business from downtime, data loss, or reputation damage. As we’ve seen with other types of insurance, such as property or health insurance, simply holding a policy doesn’t mean you’re immune to risks.

While cyber insurance is designed to mitigate financial risks, insurers are becoming increasingly discerning, often requiring businesses to demonstrate adequate cybersecurity controls before providing coverage. Gone are the days when businesses could simply “purchase” cyber insurance without robust cyber hygiene in place. Today’s insurers require businesses to have key controls such as multi-factor authentication (MFA), incident response plans, and regular vulnerability assessments.

Moreover, insurance alone doesn’t address the critical issue of data recovery. While an insurance payout can help with financial recovery, it can’t restore lost data or rebuild your reputation. This is where a comprehensive cybersecurity strategy comes in — one that encompasses both proactive and reactive measures, involving components like third-party data recovery software.

The role of insurability controls

To be insurable, organizations must meet certain cybersecurity criteria — what I like to call “insurability controls.” These controls aren’t just a checklist to meet insurance requirements; they’re also essential elements of a comprehensive cybersecurity maturity framework. Key among them are:

• Multi-factor authentication (MFA): A foundational requirement for accessing sensitive data and systems.
• Endpoint detection and response (EDR): Modern cyber insurance often mandates advanced detection and response capabilities to quickly identify and mitigate threats.
• Backup and recovery systems: These systems are the last line of defense in ransomware attacks. Ensuring backups are immutable, tested regularly, and stored offsite (air gapped) can be the difference between full recovery and total disaster.

At Keepit, we emphasize the importance of ensuring your backups are not only frequent but also resilient. Regularly testing the recovery process is essential. Many organizations overlook this crucial step, only to discover their backups are either corrupt or ineffective when they need them most. Practicing recovery ensures you’ll be able to bring your systems back online with minimal impact in the event of an attack.

Defense in depth: Beyond cyber insurance

Insurance is a vital part of your risk management strategy, but it needs to be layered with other defenses. A “defense in depth” approach means deploying multiple layers of security controls throughout your organization, ensuring that even if one layer is compromised, others can still protect your critical data and operations. This includes:

• Employee training and awareness: Your staff is often the weakest link in your security chain. Ensuring they’re aware of phishing attacks and social engineering tactics is critical. Regular phishing campaigns and security awareness training should be a cornerstone of your strategy.
• Third-party risk management: Often, cyberattacks originate not from within your organization but through trusted third parties. It’s essential to vet your partners and ensure they adhere to the same security standards you do — and consider their sub-processors.
• Incident response and retainers: Having a well-developed incident response plan is crucial, but so is having a retainer with a third-party provider who can immediately step in to help in the event of an attack. This adds an additional layer of protection and ensures a faster response time.
• Data governance and classification: Understanding what data you hold, where it resides, and how critical it is to your operations will help you protect your most valuable assets. Ensure that you’ve got policies in place for classifying and safeguarding sensitive data. If you don’t know what to protect, how will you protect it?

Data governance: Identifying and protecting the crown jewels

At the heart of any effective cybersecurity strategy is robust data governance. Understanding what data you have, where it resides, and how it is classified is critical to protecting your organization’s most valuable assets. Many organizations fail at the first step of cybersecurity — data identification — because they haven’t fully mapped out their data environment. The NIST cybersecurity framework puts understanding and assessing cybersecurity posture as step one.

Effective data governance ensures that critical data is classified correctly, protected adequately, and monitored continuously. If your organization hasn’t yet mapped out its data environment, now is the time to start.

Engaging the board and leadership in cybersecurity strategy

One of the most challenging aspects of building a resilient cybersecurity program is obtaining buy-in from the executive team and board of directors. As CISO, it’s my responsibility to communicate the risks in terms that resonate with leadership: operational continuity, financial impact, and reputational risk.

Framing security investments as business-critical decisions helps drive the necessary financial and strategic support for comprehensive cybersecurity measures. It’s essential to engage the board by linking cyber resilience directly to business outcomes — such as maintaining customer trust, complying with regulations, and ensuring business continuity in the face of ransomware threats.

For many organizations, cybersecurity is still seen as an IT problem. But in reality, it’s a business risk that requires input from every level of the organization. Encouraging open dialogue between IT, security, and the board ensures that security measures are not only implemented but actively supported across the organization.

Conclusion

Cyber insurance plays an important role in mitigating the financial impact of ransomware attacks, but it’s by no means a complete solution — and insurers have many more requirements before any coverage is offered. Businesses must embrace a comprehensive, defense-in-depth approach that includes insurability controls, regular testing of backup and recovery systems, and ongoing communication with both employees and executives.

As ransomware continues to evolve, so too must our defenses. By building a cybersecurity maturity framework based on insurability controls, regular testing, and proactive measures, businesses can ensure that they not only meet insurance requirements but also create a truly resilient organization. Only by preparing for the inevitable can we ensure that our businesses not only survive but thrive in the face of cyberthreats.

Executives express lack of confidence in protective measures and are unclear on where responsibilities for data protection lie

Copenhagen, Denmark – October 10, 2024 – Keepit, the world’s only vendor-independent cloud-native data protection platform, today released results from a recent survey. As SaaS applications become critical components of modern business operations the survey, conducted by Gatepoint Research for Keepit, reveals a troubling gap in confidence among executives regarding the protection of their SaaS data. The “SaaS data protection confidence survey”, which gathered responses from 100 senior decision-makers across industries such as finance, healthcare, technology, and manufacturing, shows that while businesses increasingly rely on SaaS tools, many leaders are not fully confident in their ability to safeguard their data.

The survey will be a key focus of an upcoming webinar titled “Protecting your SaaS data – pitfalls and challenges to overcome”, scheduled for October 17, 2024. This event will provide industry professionals with actionable insights on how to bolster their SaaS data protection strategies and ensure compliance with evolving global regulations.

SaaS data protection confidence is low 

According to the survey, while 28% of respondents expressed high confidence in their data protection measures, a significant 31% reported moderate to severe lapses in their data protection. This lack of confidence is alarming as the use of SaaS applications continues to grow, with critical data stored in applications like Microsoft 365, Salesforce, and Power BI.

“Moderate confidence in SaaS data protection is not enough in today’s threat landscape,” said Paul Robichaux, Senior Product Director of Keepit and Microsoft MVP. “Organizations must ensure their data recovery processes are robust and regularly tested. Otherwise, they risk discovering weaknesses too late, when a disaster has already struck and they’re trying to recover.”

Compliance and data growth are major challenges

The survey reveals that 50% of respondents cite increased compliance requirements as their top challenge, with growing data volumes and the complexities of managing SaaS data also ranking high. As global regulations like NIS2 and DORA become more stringent, organizations are under pressure to ensure their SaaS data is adequately protected and compliant with these evolving mandates.

“In the financial industry, for example, DORA requires that backup environments be segregated from production environments to reduce risk.  And we know that many organizations aren’t well-prepared to meet these requirements,” noted Robichaux. “The rising volume of data, combined with increasingly complex regulations, presents a significant challenge for many organizations.”

Financial and reputational risks drive data protection priorities

The survey also highlights the financial and reputational risks associated with data loss. 57% of respondents identified brand and reputation damage as the most significant business impact of data loss, followed closely by financial consequences and regulatory compliance violations.

“Customer data is among the most valuable assets an organization holds,” said Robichaux. “Losing access to that data, whether through ransomware or accidental deletion, can have devastating financial and reputational consequences. Organizations need to take a proactive approach to ensure their SaaS data is protected.”

The big SaaS data backup disconnect

While 58% of respondents reported using Microsoft to back up their SaaS data, there is a disconnect between perception and reality. Many executives mistakenly believe their data is fully protected by native SaaS backup features. However, shared responsibility models mean that SaaS providers are not accountable for customers’ data backup, leaving a critical gap in protection.

“Only 15% of respondents consider backing up directory and identity services like Entra ID to be crucial, even though losing access to these services could cripple business operations,” Robichaux added. “This shows a need for better education around SaaS data protection.”

Budget and expertise are key roadblocks

When asked about the roadblocks to improving their data protection strategies, 56% of respondents cited budget constraints, while 33% noted a lack of expertise and resources. Many organizations also face the challenge of managing multiple data backup vendors, further complicating their efforts.

To help organizations navigate these challenges, Keepit will host a free webinar titled “Protecting Your SaaS Data – Pitfalls and Challenges to Overcome” on October 17, 2024, at 4:00 pm CEST. The webinar will delve deeper into the survey results and provide actionable insights into:

• Managing compliance with evolving global regulations
• Testing recovery procedures to ensure preparedness
• Mitigating financial and reputational risks associated with data loss

Attendees can also participate in a live Q&A session with industry experts and take a benchmark test to see how their organization stacks up.

Register for the webinar here.

For many years, the 3-2-1 backup rule has been the gold standard for ensuring the protection of business-critical data. The principle suggests organizations keep three copies of data on two different storage media, with one copy being stored offsite to ensure continuity. But in today’s world, where businesses rely heavily on cloud software-as-a-service (SaaS) data, what does “offsite” really mean?

What does offsite mean for cloud SaaS data protection? 

When the 3-2-1 backup rule was coined, “offsite” meant something very tangible: You stored your backup data somewhere other than your office (or its basement, for that matter). This created a physical “air gap,” ensuring that if your production data were compromised, your backup data remained safe and untouched outside of the domain of your primary dataset.

But what does “offsite” mean when your data is already hosted by a third-party provider like Microsoft, AWS, or Google? This question is one of the key reasons experts and analysts suggest updating the rule. In a cloud environment, “offsite” means storing your backup data on a separate infrastructure/domain. Put simply, you need to store backup data in a different cloud from your production data, creating a logical air gap, like storing backup tapes in another physical location. 

As businesses move more of their operations to SaaS solutions, they generate more data in the cloud, potentially exposing a gap in SaaS data protection by not ensuring adherence to air-gapped data protection. A key vulnerability arises when backup and production data reside within the same cloud environment. This means a single data loss event or cyberattack could compromise both production and backup data.

By definition, a backup must be taken and stored elsewhere. Amazon Web Services (AWS) defines data backup as “a copy of your system, configuration, or application data that’s stored separately from the original.” So, to have a true backup copy of production data of SaaS applications that are on AWS, for example, this backup copy would need to be stored outside of the AWS cloud.

Why analysts suggest the 3-2-1 backup rule needs an update 

With the migration to the cloud, organizations have shifted away from traditional storage methods like tape. To help face challenges like ransomware and stricter data loss protection requirements, industry analysts recommend updating the 3-2-1 rule to better frame how to protect the massive amounts of data generated in third-party, off-premises SaaS applications like Microsoft 365 and Entra ID.

They believe, given these trends, the classic 3-2-1 backup strategy may no longer be enough. Some industry analysts and experts suggest businesses consider the 4-3-2-1 or 3-2-1-1-0 backup strategies instead. (If you’d like to learn more about the 3 2 1 rule, Keepit’s CTO wrote an in-depth blog that covers how it applies to modern cloud data.)

So, what are the new backup strategies analysts recommend?

• The 4-3-2-1 backup rule: This approach expands on the traditional rule by recommending four copies of data, potentially including a high availability (HA) copy, using three different storage types in two locations, with one copy stored offsite/in a separate administrative domain. This enhanced strategy aims to ensure better data loss protection through additional redundancy and improved recovery times in the face of cyberthreats. It adds an extra safety net of ensuring an air-gapped backup copy, reducing the chances of total data loss.

• The 3-2-1-1-0 backup rule: The 3-2-1-1-0 strategy takes the classic rule and adds further resilience. Here, you would still maintain three copies of your data on two storage types, but also include one copy on immutable storage, which is critical for preventing ransomware from corrupting your backups. Additionally, one copy is kept offsite, outside the production environment, and there should be zero backup errors — a goal to aim for through frequent and ongoing testing and verification. 

The role of immutable backups and air gapping in SaaS data protection 

One key recommendation is the use of immutable backups. Immutable backups cannot be altered or deleted, providing an extra layer of security against ransomware. Data immutability ensures that even if systems are compromised, your data stays intact within these backups, ensuring faster, safer recoveries.

Air gapping is another crucial consideration. This involves keeping at least one copy of your data entirely isolated from your production network, preventing malware or hackers from reaching your backups. If one system is compromised, the isolation between administrative domains ensures other systems remain safe. Read why you need air gapping.

Though air-gapped systems may involve more complex multi-cloud setup, they are highly effective for long-term data protection. There are backup-as-a-service (BaaS) specialists who own and operate their own infrastructure, making it easy to deploy the new data protection strategies focused on air gapping and immutability of cloud data. 

The future of SaaS data backup

As organizations increasingly embrace SaaS applications to manage workflows and store critical data, the need for robust, cloud-optimized backup strategies will only grow. The future of SaaS data backup will likely revolve around several key advancements driven by evolving cybersecurity threats and the unique needs of cloud environments.

One significant trend is the rise of intelligent, automated backup solutions. These systems leverage artificial intelligence (AI) and machine learning (ML) to identify patterns in data usage, predict vulnerabilities, and optimize backup schedules and storage allocation. AI-driven automation ensures backups occur at the most critical times, while minimizing storage costs and streamlining recovery.

Data sovereignty concerns and privacy regulations such as GDPR and CCPA are also shaping cloud backup strategies. We can expect more solutions prioritizing compliance, allowing organizations to store data in geographically appropriate locations while maintaining backup integrity.

As multi-cloud environments become the norm, businesses will need strategies that span different cloud platforms. This diversification enhances resilience but requires solutions that can seamlessly manage data across multiple environments, ensuring quick recovery without loss. Cross-cloud replication and disaster recovery (DR) are becoming essential in this multi-cloud world.

Lastly, the integration of blockchain technology (Merkle trees) for immutable and verifiable backups plays a role in SaaS data protection’s future. Data immutability helps ensure that backup data cannot be tampered with, providing strong protection against ransomware and insider threats. 

Final remarks: Is the 3-2-1 backup rule outdated? 

The classic 3-2-1 backup rule has served businesses well for decades, but industry analysts believe the shift to cloud SaaS environments necessitates modern adaptations to the rule to help frame and clarify which elements are vital to avoid dangerous gaps in SaaS data protection. Whether following the 4-3-2-1, 3-2-1-1-0, or the 3-2-1 rule, businesses must prioritize immutability, air gapping, and cross-cloud redundancy to ensure comprehensive data protection.

Ensuring your approach to data protection incorporates immutable backups and air-gap strategies will significantly enhance your ability to prevent data loss and maintain the integrity of your cloud data backups. By adopting these best practices, you can better safeguard your data and operational resilience — even in the face of the most sophisticated attacks.