{"id":92804,"date":"2024-11-05T15:28:57","date_gmt":"2024-11-05T07:28:57","guid":{"rendered":"https:\/\/version-2.com\/?p=92804"},"modified":"2024-11-20T16:40:15","modified_gmt":"2024-11-20T08:40:15","slug":"real-world-recovery-saas-data-backup-as-the-cornerstone-of-cyber-resilience","status":"publish","type":"post","link":"https:\/\/version-2.com\/zh\/2024\/11\/real-world-recovery-saas-data-backup-as-the-cornerstone-of-cyber-resilience\/","title":{"rendered":"Real-world recovery: SaaS data backup as the cornerstone of cyber resilience"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>

In today\u2019s digital landscape, where cloud-based services like Microsoft 365 dominate, cyber resilience has become a top priority for organizations. Businesses are increasingly relying on SaaS (software-as-a service) platforms, assuming that all their data is secure. However, without the right backup strategy, they may find themselves vulnerable in the face of data loss or a cyberattack.<\/p>

In this post, I want to share a real-world experience from a client that highlights the importance of SaaS data recovery and how it plays a crucial role in maintaining operational continuity.<\/p>

A crisis unfolds<\/h2>

One of our partner\u2019s clients, who remains anonymous due to confidentiality agreements, faced a daunting cyberattack that compromised their Microsoft Azure AD (Entra ID). Like many businesses, they believed their data was safe in the cloud, under Microsoft\u2019s protection. What they didn\u2019t realize, however, is that Microsoft\u2019s services are not immune to data loss or breaches, and the responsibility for safeguarding data ultimately lies with the customer. This is part of what\u2019s known as the shared responsibility model, where cloud providers handle infrastructure security, but data protection remains the customer\u2019s responsibility. Read Microsoft\u2019s shared responsibility in the cloud (source: Microsoft).<\/a><\/p>

When the attack occurred, the client was caught off-guard. Administrative accounts were compromised, some user accounts were maliciously deleted, and there were attempts to exfiltrate sensitive data from SharePoint. The customer\u2019s crisis committee immediately launched an investigation, but they quickly ran into a roadblock: Azure AD only retains logs for 30 days, making it impossible for them to perform an in-depth forensic analysis of what had transpired.<\/p>

The flow of recovery<\/b><\/h3>

By using Keepit backup and recovery for Microsoft Entra ID (formerly Azure Active Directory), we were able to act quickly in response to the cyberattack in three broad steps:<\/p>