Why cloud-based resources still need effective backup

As businesses have come to terms with the benefits of cloud platforms, many are working to shift ever larger proportions of their IT workloads to this more flexible environment.

In many cases, the trend is being led by the adoption of Microsoft 365, which gives businesses the ability to shift data to the cloud and make it as available to staff as it was when being held on premises.

Concerningly, however, many business leaders are under the misapprehension that if they shift data to the Microsoft cloud, they are absolved of any associated security requirements. They think that if data has been transferred to Microsoft, it's that company's job to keep it protected from threats such as ransomware attacks.

Unfortunately, this is actually not the case. In its terms and conditions, Microsoft makes it very clear that users should arrange for third-party data backups to be maintained. However, many people remain unaware of this requirement.

Microsoft 365 as a ransomware target

Because it is a storage location for ever-increasing amounts of business data, Microsoft 365 has become a favoured target for cybercriminals. In many cases, phishing campaigns are mounted in an attempt to gain legitimate login credentials, which then provide direct access to files.

In other cases, cybercriminals have been using API calls to gain access to the Microsoft cloud and attack data in both SharePoint and OneDrive. The attackers have focused on the versioning capabilities of these applications and reduced the number of held versions of documents and files from more than 50 to just two, which are both encrypted.

This meant that victims were unable to avoid the ransomware attack by simply reverting to earlier versions of documents and other files. They found themselves stuck and faced the real prospect of having to pay the demanded ransom.

These cases make it clear that having an external backup of sensitive data held in Microsoft 365 is vital. This will allow business operations to get back up and running as quickly as possible should a ransomware attack occur.

It also points out the benefits of having multi-factor authentication tools in place. This will significantly restrict the ability of cybercriminals to gain access to the cloud-held resources in the first place.

Putting effective backup capabilities in place

It's clear that to ensure the security of data held within Microsoft 365 is maintained, a third-party backup service needs to be selected and deployed. In many cases, it will be logical to make use of a cloud-based service to remove the need for any additional on-premise resources.

There are a range of cloud-based backup services on the market; however, the leading ones will have particular features. These include:

• Quick configuration: It should be possible to have all data held in Microsoft 365 backed up to another cloud within a matter of minutes.
• Granular restore: Should it be required, particular files should be able to be restored without the requirement to restore all data simultaneously.
• No additional software or hardware required: The entire backup process should be managed by the chosen provider, without the need for any additional resources to be deployed by the business.
• End-to-end encryption: To ensure full security at all times, it is important that a chosen cloud backup provider uses end-to-end data encryption.
• Unlimited storage: There should be no limits on the amount of data that can be backed up. This will allow the business to continue to operate with confidence that all files are protected. 

Having a reliable, cloud-based backup of core files stored in Microsoft 365 will go a long way to ensuring a business can withstand a ransomware attack and, should one occur, recover quickly.

It's important that businesses take the time to understand what features are required for them to obtain the most robust and flexible backups possible. In this way, the benefits of the cloud can be maximised while security risks are minimised.