Table of contents of the article:
In an era where digitalization has reached unprecedented levels, cybersecurity has become a top priority for companies of all sizes. One of the most critical aspects of this security is backup management. Many focus on creating redundant and resilient backup systems, but few stop to think about one crucial aspect: what would happen if an attacker managed to gain administrative control of the system on which the backup resides?
The Ignored Risk
Let's imagine a scenario in which the site “pippo.it”, which uses WordPress, is compromised through a vulnerability in one of its plugins. This breach allows an attacker to exploit a flaw, perhaps in the kernel, gaining root privileges on the system. At this point, the attacker could decide to delete the website and, having access to the root user's RSA key, use it to access the backup system and delete all traces of existing backups.
Another scenario could see the attacker use the backup system itself to launch a command that deletes all backups from the last 60 days, completely emptying the repository and leaving the company without the website and without any possibility of recovery.
These scenarios, unfortunately realistic, highlight an inconvenient truth: a backup system that allows the deletion of data, even if managed through procedures that seem legitimate, cannot be considered safe.
Security in Backup Systems
When it comes to data security, the focus shouldn't be limited to the redundancy or resilience of backup systems, but extend to their impenetrability and absolute integrity. The true security measure of a backup system lies in its ability to make data immune to any attempt at unauthorized access or alteration . In this context, implementing immutable backups emerges as a key strategy. These backups, once written, cannot be modified or deleted, even by the user with the most stringent access credentials. This feature ensures that, regardless of threats, data remains intact and secure.
To achieve such a high level of security, it is crucial to adopt the principle of least privilege, limiting access to backup systems only to strictly necessary personnel and constantly monitoring all activities. Authentication protocols must be robust, moving beyond simple RSA key-based authentication to include more sophisticated methods such as multifactor authentication, which adds an additional layer of protection.
Furthermore, designing a secure backup system requires an architecture that categorically excludes direct SSH access to the backup servers, thus preventing any attempt at remote data manipulation. This also requires a strict command management policy, which should never allow backup deletion, even if apparently authorized by a backup client. Creating an environment where backups are immutable and inaccessible for deletion, whether intentional or not, is the foundation for ironclad data security.
Immutable backups act as a bulwark against a wide range of threats, including ransomware attacks that aim to encrypt or delete data for ransom. With backups made unalterable, companies can quickly restore their systems without giving in to attackers' demands, thus ensuring operational continuity and protection of critical data.
Open Source Security: Borg and Restic
Fortunately, there are open source tools that can offer adequate levels of security for backup management. Borg and Restic , for example, offer "Append Only" modes that prevent attackers who gain elevated privileges on the system from deleting backups . This feature is particularly important not only for protecting data from external attacks but also for preventing malicious actions by untrustworthy employees.
Implementing an Append Only mode means that even if a malicious user or an employee with access to the backup keys decides to delete the data, the system simply won't let them. This type of protection adds a critical layer of security, ensuring that backups remain intact and available even in the face of sabotage attempts.
Conclusion: True Backup Security
The security of a backup system is not only measured by its ability to resist hardware failures or human errors, but also and above all by its resilience against targeted cyber attacks. A backup that can be deleted, no matter how technically advanced, does not offer the security guarantee that businesses desperately need in the digital age.
Solutions exist and are within reach. Tools like Borg and Restic, with their Append Only modes, offer a concrete example of how it's possible to build backup systems that not only safeguard data but also ensure it remains safe from anyone who intends to delete it . Ultimately, backup security is a fundamental pillar of a company's overall IT security, and as such, deserves adequate consideration and commitment.
