It’s unbelievable, to put it mildly, that a firm worth 200 million USD would trust its customers’ private information to a makeshift backup system. Yet it seems that’s exactly what happened with LastPass, a password manager. What’s the end result? Their client database was breached, and a backup copy of the data was taken.
If the company in question hadn’t been employing its own backup system, this current breach might never have happened. Let’s take a look at the process of creating homemade backup systems, and why this leaves networks open to hackers.
Making Your Own Backup System
At first glance, backups appear to be uncomplicated: just move data from one location to another and use versioning so that you may roll back to a previous save point if necessary. You may think that writing a shell script is all that’s required to take use of today’s cloud-based storage and bandwidth.
You’ll need the shell script to authenticate itself with the cloud storage, which can be done by simply entering a username and password into the script.
Now your data will be automatically backed up to a safe location in the cloud at regular intervals without any more intervention from you. If anything could go wrong, it wouldn’t be this.
How It Went Wrong
Imagine that a hacker gained access to another service your company utilises, and now that service is affecting your development environment. Over several days, the intruders were able to access your network without being noticed. Where can I find a quick solution to this issue? Passwords should be changed immediately.
So, what about the backup script you wrote yourself? What if the intruder ran a network scan, located your backup script, and read it in order to steal your credentials? They would still be able to locate the script regardless of whether or not you changed the password. They might pose as your company’s IT department and access your cloud storage, giving them access to your client database and other files.
Naturally, encrypting this kind of information is recommended. On the other hand, the cold hard truth is that there are occasions when it just isn’t. The above description illustrates how a hacker gained access to LastPass user accounts. The password vault encrypted only the usernames and passwords it held.
Skilled Backup and Recovery Are Required
The attack of LastPass illustrates the perils of relying on a homegrown backup mechanism. Organizations must implement a professional cyber protection and recovery system to guarantee the security of their backups. In reality, they must “shift left” and consider not only data protection but also data resilience. Data resiliency involves securing your systems against new threats and ensuring that your organisation is always prepared to recover rapidly following an attack.
With backup and protection, replication, and disaster recovery, a data resiliency solution ensures that your data is both secured and recoverable. This is despite ‘conventional’ hazards (such as user error, system failure, and site disaster) and next-generation threats (such as ransomware, supply chain attacks, and insider threats).
You would no longer need to hardcode usernames and passwords in a backup script if you had such a data resilience solution. Hence, even if a hacker obtained access to your data centre for weeks, they would be unable to locate any information that would allow them to breach your backups. Your backups would be stored offshore, encrypted, separated by air gaps, and managed independently.
Seems lot safer, wouldn’t you agree?
Organizational Reputation at Risk
Hacking incidents like the one that affected LastPass serve as a warning to all of us and are disastrous for the organisations involved. Businesses lose billions of dollars annually due to improper data security and resilience procedures, as well as reputational harm, ransom payments, and costs for data recovery companies. Consumers and other stakeholders evaluate businesses more and more depending on how they respond to and recover from such attacks.
Companies cannot afford to rely on in-house backup systems in such a situation. Companies must prioritise data security and resilience and invest in reliable solutions that ensure the security of their sensitive data and, more critically, the data of their clients.