The Critical Role of Secure Backups in Cyber Security: Lessons from Recent Cyber Attacks

In today's digital landscape, cyber threats and  the cybercriminal actions involved are more sophisticated than ever. Businesses must be prepared for the worst - you have to presume an attack will happen against your organisation.

Recently the retail sector has been widely targeted and the prominent Marks & Spencer cyber attack is a stark reminder of how devastating a breach can be. The attack, which is still disrupting online operations and has led to the theft of customer data, is expected to cost the company £300 million and to continue causing disruptions through July 2025. Incidents like these highlight the critical need for robust backup strategies to ensure data recovery and business continuity. 

When the worst does happen and to ensure that any data you backup remains readily available for a quick and seamless restore, it's essential to consider both the backup location and the type of media or technology used.

Understanding Backup Target Strategies: Air-Gapped vs. Immutable Storage

When securing backup data, two key methods stand out: air-gapped storage and immutable storage.

• Air-Gapped Storage: This method involves keeping backups completely disconnected from the internet and internal networks. Since cybercriminals cannot access air-gapped systems remotely, they provide maximum protection against ransomware and data breaches. However, they require manual handling and can slow down recovery times.
• Immutable Storage: This approach ensures that once data is written, it cannot be altered or deleted, even by administrators. Immutable backups are ideal for preventing ransomware attacks, as they prevent unauthorised modifications. Since they remain connected to the system, they allow for faster recovery but require strict access controls to prevent exploitation.

Backup Target Technology for Air-Gapped & Immutable Storage

Each backup method can store data using different target systems, each with its own benefits:

Air-Gapped Target Options

• Tape Storage: One of the most traditional and secure air-gapped methods. Tapes are physically stored offline, making them impervious to cyberattacks. They are cost-effective for long-term archiving but have slower recovery times.
• External Disk Storage: Keeping backups on external drives (HDD/SSD) or disconnected NAS systems ensures data is safe from online threats. However, they require manual handling and regular updates.
• Offline Server Storage: Some organisations consider maintaining cold storage servers, which remain physically disconnected from networks except during scheduled backup operations.

Immutable Targets Options

• Cloud Storage with Object Locking: Many cloud providers offer immutable storage solutions, such as Amazon S3 Object Lock or Microsoft Azure Blob Immutable Policies. These ensure files cannot be deleted or modified, making them perfect for ransomware protection.
• On-Premise Storage with Object Locking: As with the above Cloud options, there are vendors in the marketplace who offer S3 featured storage but built into easy-to-deploy appliances.
• WORM (Write Once, Read Many): These specialised drives/media allow data to be written only once, preventing unauthorised changes or deletions.
• Immutable File Systems: Solutions like ZFS or Linux provide built-in immutability, protecting data from accidental or intentional modifications.

Why Secure Backups Matter

• Business Continuity: Without proper backups, companies risk prolonged downtime, leading to financial losses and reputational damage.
• Ransomware Defense: Immutable backups prevent attackers from encrypting or deleting critical data.
• Regulatory Compliance: Many industries require organisations to maintain secure backups to protect customer data.
• Disaster Recovery: Whether due to cyberattacks or system failures, backups ensure that operations can resume swiftly.

Beyond air-gapped and immutable storage, organisations should implement additional security measures, such as:

• Multi-Factor Authentication (MFA): Prevent unauthorized access to sensitive systems.
• Zero Trust Architecture: Limit access based on strict verification protocols.
• Regular Security Audits: Identify vulnerabilities before attackers exploit them.
• Cyber Insurance: Helps mitigate financial losses from cyber incidents.

Enhance Cyber Resilience with COOLSPIRiT's GUARDiAN Appliance & Commvault Software

Beyond physical backup strategies, data management appliances play a crucial role in cyber resilience; introducing our GUARDiAN Appliance, which integrates seamlessly with Commvault to provide enterprise-grade data protection.

GUARDiAN Appliance with Commvault Key Features:

• Integrated Compute & Storage: The GUARDiAN Appliance combines compute, storage, and full lifecycle data management into a single platform, simplifying backup and recovery.
• Immutable Architecture: Built with zero-trust isolation, air-gapped capabilities, and storage I/O controls, the appliance ensures ransomware resilience.
• AI-Driven Threat Detection: Commvault uses machine learning to detect anomalies in data patterns, helping organisations identify potential cyber threats before they escalate.
• Multi-Cloud Protection: Supporting hybrid cloud environments, allowing organisations to secure data across on-premises, cloud, and SaaS workloads.
• Multi-Tiered Backup Strategy: With Commvault’s intelligent data management integrated, organisations can automate backups, detect anomalies, and recover data efficiently.
• Pre-Configured & Ready to Deploy: The appliance is pre-designed, built, and installed by Commvault Expert Certified engineers, reducing complexity and deployment time.

Lessons from the recent Cyber Attacks in the retail sector

The Marks & Spencer cyber-attack was reportedly caused by human error, allowing hackers to infiltrate the company's IT systems through a third-party vulnerability. In the retail sector, breaches such as these can lead to depleted shelf stock, halt online orders, and put customer data at severe risk, affecting both operations and reputation. These incidents underscore the importance of having a reliable backup strategy to restore critical systems quickly.

Final Thoughts

These recent, well-documented, cyber attacks serve as a wake-up call for organisations. Investing in secure backup target technology, whether air-gapped or immutable, can mean the difference between a swift recovery and a catastrophic loss. By combining strong cybersecurity practices with robust backup strategies and advanced data management solutions like the COOLSPIRiT GUARDiAN Appliance with Commvault, organisations can safeguard their data and ensure resilience against future threats.

COOLSPIRiT is here to help you keep secure

To find out more about GUARDiAN appliance, visit our webpage here.

Alternatively, contact our expert team today at hello@coolspirit.co.uk or call 01246 454222.