Hello and welcome to another
application of the or attack
framework discussion today,
where you're going to be looking at
our case study on impact.
So our little saying here is
rather be safe than sorry.
And in this case, we're going to
look at top disaster recovery
failures with respect to backups
and things of that nature.
And so the common one here
is that the media is not working
or device failure.
So we as we moved away from tape
backups and we don't use floppies
anymore, knock on wood, hope not
hard drive failure is less and less
common, but it still happens.
And it is one of the top areas
for why backups do not happen,
do not work.
And so testing media is
huge.
Human error is next here.
And proper backup scheduling or
improper storage is
just two of the many ways that we
as human beings can make mistakes
which result in us not getting
all of the necessary data we need,
or in losing that data at
a later date.
Software updates lead to failure.
So we may blindly assume
that our software is running
as expected and that nothing is
wrong. And then updates happens.
Things change.
Suddenly we're not getting the
things that we should be getting
from the directory we thought we
were getting it from.
And now we have issues that
actors can remove backups outright.
So if they find that those are
written to a local share or storage
medium, they can take that out
and then you don't have backups at
all. And then infrastructure issues,
Internet, throttling bandwidth,
throttling back up, throttling,
not completing backups in a timely
manner.
Circuits go down.
Any number of things
can lead to failure.
And so things to consider here.
How do you know that the plan will
work if you
get to the end of
these phases?
And suddenly a threat actor tosses
the proverbial hand grenade into the
network and
you lose data.
Data is encrypted, systems go
down.
How are you? Sure.
If the plan will work,
do you test backups ever?
Right. Do you have the ability to
recover in a timely manner?
If you're not testing backups?
You don't know. The plan will work
and you don't know if you have the
ability to recover.
You assume you do, but
assumptions can be dangerous things.
Have you ever validated that your
system administrators are backing up
the right information?
And this isn't a ding on network
administrators. Backup
administrators are disaster recovery
folks. It's just that
if you have an
idea of what data
sets are important to the
organization, that
idea may not be shared by
the administrators.
And so if you have data that's put
in an abnormal location, if you
have data that you think should be a
part of the backup schedule,
you need to ensure that that is
happening on a regular basis
and that it is getting backed up
because nothing would stink
more than getting to a
point where a system becomes
unavailable.
And you discover that directory upon
directory that you thought was being
backed up is not.
So all of these things are great
considerations when it comes to
addressing impact and ensuring
that you can get back to business
as usual.
So with that in mind, I want to
thank you for your time today,
and I look forward to seeing you
again soon.