Latest / The HIDDEN Podcast by Babble / Episode 6: Why Backup Isn’t the Same as Recovery

Transcript

Episode 6: Why Backup Isn’t the Same as Recovery · The HIDDEN Podcast by Babble

• Lynn Murape: Joining me in the virtual studio today is Steve Hennessy. Thanks for being here, Steve. Welcome to the HIDDEN™ Podcast, where we simplify cyber security and all things tech for those of you who, like need it to be explained without all the So if you've ever wondered why you still feel vulnerable even though you've bought all the fancy tools, come to the right place. ⁓ your host, Lynn Murape and job is to take one of our resident experts and help them translate their cyber expertise into plain This means having practical conversations That's a wrap on today's episode of the HIDDEN™ podcast. If this episode gave you an aha moment that helped you untangle something that's been bugging you, subscribe and share it with a friend who's in the same boat. And if you're wondering where you stand across the six HIDDEN™ layers, our cyber security snapshot in the description below. a lot less painful than a breach. Until next time, don't let your risks stay HIDDEN™. Steve Hennessy: Delighted to be here, Lynn. Thanks for inviting me. Lynn Murape: Always a pleasure. So before we dive into the episode, do you mind telling our friends listening or watching out there a little bit about yourself in terms of what you do and where you live? Steve Hennessy: Yeah, of course. So I'm Steve Hennessey. I'm one of the strategic account managers here at Babble. So I've been with the business for... little over seven years, continuously with the organisation for nearly 25, would you believe it, in July. long, time. ⁓ all that time, I've focused on IT managed services, cyber security, business So everything that comes from Babble and the associated businesses previously. So yeah, you really excited to be here and love spending time with talking about their challenges and trying to understand Lynn Murape: usually built around Babble's HIDDEN™ cyber security framework, which we break down in the show. Or sometimes we'll take a hot topic in the tech industry, like a major breach or a new legislation, and we'll explain how we help you stay ahead. Basically, this podcast exists so that you can sleep well at night, preferably not during the podcast. Steve Hennessy: and know what we might be able to do to assist and help. So hopefully some of that feeds into today's conversation. Lynn Murape: Undoubtedly, I know that it will and wow, 25 years is quite a feat. I can only imagine how not only the business itself has changed in all that time, but the industry in and of itself. ⁓ So without ado, just diving right in. So today we're talking about the case scenario, which is if a system went down tomorrow, How quickly could you Starting with that I'm sure you hear all the time, Steve, is we have backups, but why can that create a false sense of security? Steve Hennessy: There's a couple of parts to the answer really. So first of all, we have backups tick in the box, so that's great. So absolutely we should be making sure that we've got a separate copy of our data that sits outside the primary source, if the worst were to happen, we need to be able to gain access to it. But think ⁓ what often overlook is, has that been tested? Is that data readily available? And to your point, how quickly can we gain access to it? And usually you're going to be able to understand that by going through some testing phases and also talking with your partner about what you want to achieve. So how quickly do you need to be able to gain access to that data? example, if you wanted to recover an entire mailbox, then might be waiting hours, days, weeks, depending on the size of that information. Whereas if it's just a single file or folder, you might be able to recover that quite quickly. think understanding talking with the customer and them talking with ourselves about it is that they're trying to achieve is absolutely key to answering that question. Lynn Murape: Yeah, definitely a lot to unpack there, especially around this importance of testing that data, right, which is what we're going to get into in a little bit. But something else that you said jumped out at me terms of how quickly you're able to restore data. ⁓ Is exclusively linked to how much data you're trying to restore? You had mentioned that of whether it's a single file compared to, you an entire mailbox. Is that the only factor that basically determines how quickly one is able to restore their data? Steve Hennessy: Well. There's a few things that feed into it. So in a lot of circumstances, the backup might not be held locally. So it might be held in a cloud repository or an offsite repository of some description. in case, when you drag the data back again, you're to have to do so through an internet connection. So that will definitely have an impact on the ability to recover ⁓ as to, you know, we've all used USB for our home data backups, potentially for photographs, et cetera. Plugging that into the side of your machine, you can recover that information very, very quickly. if you imagine trying to drag that size of information across an internet connection, whilst people are utilising it, that can have a big impact on it. So connectivity is big factor. And also to point, the size and type of data that you have. So the amount of that trying to recover will certainly have an impact on things, but also nature of that data, some data can be quite large to begin with, and can be condensed down or the data, size that it is on first is the size that it is when it's backed up somewhere else so that information can take a bit longer to be able to drag back. Lynn Murape: Mm. Okay, great points, well made as usual. you know, it just got me thinking about the statement which is backups aren't tested regularly often fail when they are needed most. So Steve, your experience, how commonly does the average small business perform restore testing? Steve Hennessy: Well. What you tend to find, Lynn, is that customers will do restores by design, and what I mean by that is will need files individual pieces of information, and so they'll go to the backup to drag that information back. So I might delete a folder or I might delete a piece of information in my email. So I can go to my IT team and they can drag that information back quite quickly. That's not really a test. That's just an of being able to gain access to the backup. When we talk about testing, what we really mean there is the facility to be able to drag either everything or the large amounts of information back and how long that takes. so that testing process is around, can I do it first and foremost, which is super important. And secondly, how long does it take for me to do it? So if I want to bring back a percentage portion of the data that I have, ⁓ how does it take me to recover ten, fifteen, fifty, a hundred percent of my data? And when I understand that I can then start to prioritise in what order I would want to receive that information. So for lot of businesses it might be that there'll be key pieces of information that you want to recover first. So it might be that part of the testing process is how long is it for me to just gain access to that data and then secondary might want to understand how long it takes to recover larger percentages of the data. and then ultimately all of it. Lynn Murape: It also reminds me of the previous episode which we had with Nisha around data controls and the importance of labeling your data. So I think that could hand in hand. As you're labeling what is sensitive data, what is data that can be shared externally versus only in certain departments, et cetera, et cetera, can also be coincided with the process that you just outlined now in terms of just classifying that data into is the absolute minimum as far as the most important data that we need to keep the business and running. And then the rest we can recover in phases because of course it's going to take a long period of time depending on how much data has been lost. Steve Hennessy: Absolutely, yeah, and that as a process as part of the understanding of what your backup looks like and how it works is because what you don't want is to, the first time that you have to deal with that is in the event that you're trying to capture that information again. You know, there's going to be lots of stuff going on, you're not going to be in a great place, you would assume. So what want do is make sure that you've understood that first. So I think absolutely prioritising your data and understanding the of that data is really important. Lynn Murape: Definitely. right, so the next question that I have for you here is why so many businesses, again in your experience, ⁓ assume they can recover their data instead of actually going ahead and proving it? Steve Hennessy: I think it's just one of those things that's human nature, Lynn, where a customer buys a service of some description and then naturally assumes it's going to do exactly what it says on the tin. But unfortunately, from a technology point of view, that's not always the case. quite often that's where organisations like Babble will come into that. Because everything did exactly what you're supposed to, you would never need probably an organisation like us to help you with it. You would just buy everything off the shelf and it would work first time. But that's ideal way. and none of us live in that. So really need to make sure that we are testing what we're understanding is being purchased from a backup perspective and that we've got a really clear understanding about what is we're buying and what we're getting in return. Because again often customers will misunderstand the whole backup term mean all to everybody in terms of if I have a disaster that gets me back up and running again if someone my information, I can everything back instantly, or if it's in the sort simplest element where you're just trying to recover a single file, that that can happen instantly. So I think having a really good understanding and having that conversation with your partner in our case Babble, so that you can be clear on what it is you've bought and what you're likely to get in return is absolutely key. Lynn Murape: You can buy all the best of breed solutions that there are out there, but it's also about how you it and making sure that you leverage the most out of it. ⁓ But something else that you said jumped out at me when you mentioned ransomware, Because we of course are going to tie this back to cyber security. So Steve, in your why are attackers increasingly targeting backup systems first. Steve Hennessy: If you think about the concept of what those people are trying to do when they carry out these attacks, they want to put the victim, let's call into a situation where they're into a corner and they have to do what they're being asked to do. So in this case, let's say, pay a ransom of some description. So if I have something over here and then I a duplicate copy of it over here, it makes sense that if you take away my copy, then only got one version of the truth. So you then stop that from being accessible, I'm bound by whatever it is that you're asking me to do. So it makes more sense nowadays to try and get that backup option and that secondary copy of your data. Because if they can render that useless or indeed inaccessible, then that of view, they really do have you in a tight spot if they're then able to access the primary data. So I think that's mainly the reason why are targeting the backup and then going after the primary data secondary. Lynn Murape: Yeah, would you add to that maybe the fact that people not everybody of course, people tend to take their backups for granted, you know, as we were talking about not necessarily testing that recovery as often as they should, et cetera, et cetera. So because they don't really have that focus on ⁓ their backups, they're obviously looking at the data that they're working on in real time that's sitting within the organisation. So that's basically what tends to get the most as far as the and the focus is concerned. And then just assume that your backup is just your backup in case something goes wrong, but somebody could actually be targeting and trying to get into that backup system well. Steve Hennessy: Yeah, absolutely. I mean, you know, a common misconception when you talk to customers is that my data is in Office 365, Microsoft are protecting it. And so hence, I believe that that data is being backed up. Well, in fact, that's absolutely not the case. And if you you listen to what Microsoft advise customers, they actually direct you to have a secondary separate copy of that data stored somewhere else outside of their ecosystem for that exact reason so that you a safety net to fall back on people focused on what the primary looks like and where to that and how to password protect that and as you said Lynn, that's super important as important, in more important, is what are you doing with backup copy because that's what you might need to back on in the event of a problem occurring. So really important that give the same level thought to that as you do what's happening to the primary levels of information. Lynn Murape: Yeah, definitely. And I love the fact that you brought up even the fact that Microsoft advises you to, for lack of a better term, not put all your eggs in one basket, right? So switching gears back to this notion of recovery. What are recovery time objectives? ⁓ Steve Hennessy: Recovery time objectives are you are trying to understand you want to achieve in terms of how quickly you get that information back and then that feeds how quickly that information be utilised to get systems running again. Customers won't usually use that specifically, but they'll have that thought process in mind. So what we wanna be doing is, as partners our customers is, and as the trusted advisors, we need to be asking those questions for So we need to be saying, know, okay, Mr. and Mrs. customer, we've got a copy of your data, that's great, but in what regard do you need to be able to get that data? How quickly does it need to be accessible? What elements that data will be priority, as we talked about earlier? And to that point, how quickly can we then recover it? And then we go through a process of being to test that so that the recovery time objective is achieved by the customer. So if they're saying to me, I need to be able to access this part of data and I need to be able to do that inside of two hours, otherwise I've got a serious problem on my hands, ⁓ need to look at is that achievable, is that possible? And if it is, we then need to test that theory so that we've got actual confirmation that that's the case. ⁓ Lynn Murape: Awesome. All right. So when a business goes down for 24 to 72 hours, worst case scenario, what actually happens? Steve Hennessy: Well, I mean, it really will vary from business to business. But invariably all it means is, key systems unavailable. So in the event of those systems going offline and being unavailable, again, you'd be working the customer to understand what that looks like. are lots of organisations that might be able to continue to a degree in a manual fashion. So might able to continue to carry out their day-to-day activities, albeit on a back basis because certain systems not be available to them. But there then might be organisations that if their systems go offline, they can't function at all. So maybe more transactional organisations that on maybe application stacks to process orders. So if you think about people like, I don't know, Ticketmaster or eBay, if their systems go offline, and you would hope they've got pretty good systems in place, as they've proved often in the past, they go offline, they can't function. Because I can't just walk into a Ticketmaster ⁓ or an eBay shop and carry out the same function without their platform being available, they can't function as a business. So me, it's about understanding with the customer what can you do? And what can't you do and again that calm situation prior to any problems occurring, walking that with the customer in granular detail so that together you can map out what systems key, what you need to do to provide resilience around those systems and what is non-negotiable, what has to working for them to be able to function effectively as a business. ⁓ Lynn Murape: you were speaking through all of that, would you say that these are the kinds of or factors that one would look at when you are defining those time objectives? ⁓ Okay. Steve Hennessy: Absolutely, to the point I just made around those particular customers, you were providing services to an organisation that was highly reliant on a particular application, you would to be saying to them, in order to have that back up and running within 20 it's not possible for us to actually use a backup to drag that information back again. What we're going need is something that gives you a level of business continuity or disaster recovery. So you're encroaching into a area, probably in a similar family to back up, but it's not the same thing and that's really important when we're talking to a around that. So they might say to themselves from a non-technical point of view, I need a backup of my systems. Again, it's our job, Lynn, to talk to the customer and unpack that with them. When they say that, what do they really mean? What are they trying to achieve? Are saying that if systems system A is not available for one hour, they lose X amount of pounds or euros or dollars or whatever the case may be. And if they are, do we need to then look at a system that allows that primary system to go offline while something else jumps into its place? And then as I say, we're in the realms then of disaster recovery and business continuity as opposed to what I would call traditional backup. Lynn Murape: ⁓ okay. So that nicely segues into the next question that I have for you, which ⁓ the difference between backup versus recovery. And you've already answered this in part, so maybe like a summary of what you've just said. So what's the technical and difference between backup and recovery? Steve Hennessy: Backup is the concept of taking another version of something, so a copy something, if you like, and having that in another location. Recovery, is about what you do to get that information back again. And when you think about recovering data, it might be that I click a button, the IT team, with much bigger brains than me click a button, and they'll dragging information back. that might take one hour, two hours, 10 hours, 24 hours, however long it's going to take. But I'm happy that as long as I get all of that information back again, no problem. From a customer perspective, their recovery might be, well, how quickly can I recover? How quickly can my business get back on its feet from the problem that they're encountering? And that's where we have to dig deeper and ask the right questions around what is it that we're talking about here? Are we talking about a copy of something or are we talking about the ability to recover from an event of some description? Lynn Murape: Nice. right. So I say put differently, of course, as you know, the layman in this conversation, just making sure I'm on the same page as you. So backup is about storage and then recovery is something that is tested. ⁓ So you have alluded a few times throughout this conversation, rightfully so, about ⁓ doing all of this in a calm state, right? But that isn't always the ⁓ So in your experience, Steve, why does disaster have to strike in a lot of cases ⁓ before business leaders, take a step back and together this business continuity plan or look at backups and look into recovery and like that? Steve Hennessy: Yeah, I think that the challenge is just one of human nature, you know, so no, no one is saying to themselves, not interested in that. I'm not going to worry about what might happen in the event of a problem. What they're doing is they're, buying a product or a service and they're saying to themselves, I've ticked that box and I'm all sorted. It's going to be taken care of. But too often what happens is potentially the hasn't been gone into as per some of the previous stuff that we've spoken about. ⁓ Or there isn't a clear understanding between the two parties, between the advisor and between the customer about they're buying and what they're getting in return. And what we when we talk to customers sometimes or potential new customers is the first they've to go to that is when the worst has happened. that's the trigger. sharpens focus. Everyone's super interested in that as a particular situation because they've gone through something that's quite painful, and so then they wanna the finer detail around it. Lynn Murape: Yeah, points, well made as usual. As you were talking all of this, it just goes to show that the importance of recovery is just helping you move from hoping that this recovery will work by testing it and documenting it and actually rehearsing it, almost a fire drill. You just want to sure that everybody in the business knows the right protocols to follow so that when disaster does strike, calm minds prevail, as they say all the time. And as said, when it happens after the fact, that's usually when tensions high, emotions are through the roof and things like that. And again going back to that element of human nature which is why we touched on human risk in one of the earlier episodes so yeah nice. Steve Hennessy: Thank Yeah, absolutely. And I think the fire drill example is a really great one. our children in schools, they'll run through that fire drill, that process of understanding what they need to do. Because of course, heaven forbid, if find themselves in a situation where they have to do it for real, they'll be under a different set of pressures and it will be scary. And so what they need to be able to do is carry out those instructions, having practiced them numerous times before. So it's a really great way to break it down, Lynn, actually from a non-technical Walking through something in the calm environment gives you the opportunity to see where potential pitfalls might be so that you don't learn about them for the first time when there's a real problem happening. Lynn Murape: Exactly. So Steve, if you had to define what the non-negotiables for Resilience are, what would they be? Steve Hennessy: Okay, so the non-negotiables for resilience. Again, talking to customers, that will usually have an impact based on the nature of the business. if you are a type of organisation, you might have to have connectivity to be able to stay up and running. So looking for single points of failure, have only got one internet connection? Have you only got one application running your primary systems? Have you only got one means to be able to access that data? then you might want to identify those and look at how you can that risk by having additional resilience place. So, you know, is a non-negotiable. You have to have a standard copy of everything you have somewhere else in a place that you can get to. So in the absolute worst case scenario, at least you can go to that and start again. And you work, for me, work backwards from that. You then start to understand how quickly do I want to recover, with what do I need to help me recover. you then start talking to the customer about what that looks like and how that might work for them and those single points of failure from a technology point of view. So are you organisation that has a contact center? Do you can't you make and take all of your calls through that contact center in such a way that if that was offline that would have a detrimental effect to your If you do you need to think about resilience. So backup forms lots of headers if you like it's not just about data, it's about having a way to recover when something happens. So I think that's why often people will use that collective term of backup and mean lots of different things for it. So that's why you have to probe from a questioning point of view and make sure you're all on the same page and really clear about what it is that you're trying to achieve. Lynn Murape: Yeah, I couldn't agree more and know just to add to that or to summarise it. Again, sure we're on the same page is you know having those managed backups and by managed we mean both monitored and protected. of course the regular restore testing, right, because that backup is null and void if you can't even access that data. And to your point earlier, Steve, about it being much bigger than just data, right, you had spoken about connectivity as well. So that's also where the business continuity planning comes in. And you also mentioned, ransomware. ⁓ So just doing that ransomware resilience testing. In a previous conversation that I had with Anton, he was talking about, penetration as well. You know, just testing that system, testing access, things like that. So I think that would also under this, if I'm not mistaken. Okay. Steve Hennessy: Absolutely, it comes back to the point that we spoke about and that you made so well early on around assumption. Don't assume something is going to happen in the way that you think it's going to happen. Test it, question it, probe it, speak to your advisor about what's their understanding about what customer wants, turn that conversation around. Because the only way through that clear communication, everyone's on the same page and then we don't have this situation where in the worst case scenario, start to find out for the first time. It's not as we anticipated because that's not a good place to be. Lynn Murape: Yeah, 100%. So that would actually be the perfect place to end this, but I do have just one more question for you, Steve, which is, if ransomware had to hit a business tomorrow, touch wood, how would one ensure that decision making remains calm and structured and not chaotic? Steve Hennessy: Okay, so It's really about having a plan. So we've touched on that a few times in the conversation, but having a disaster plan that is understood by key people in the business. And that plan should include what's happening, who's part of that, who's taking responsibility for key elements, where do your partners come those conversations, people like Babble, maybe there will be additional third that would be part of that as well. And then really walking that through in way that includes of the right people inside your organisation so that no stone's unturned. ⁓ best way to plan and prepare is to do so in advance. ⁓ if you're ⁓ sure that you've got a really clear understanding about ⁓ are the gaps in our plan, where does that start to cause us challenges, and inviting lots of independent voices inside your business into that conversation, ⁓ gonna be in a much better place to be able to have a plan that's executable and will deliver real results for you. Lynn Murape: Love I couldn't have ended it on a better note. So without further ado, thank you so, so much again, Steve, for joining us today. It's been an absolute pleasure talking to you. Steve Hennessy: Thanks for inviting me, Lynn. Loved to talk to you. Lynn Murape: Lovely.