Implementing the ACSC Essential 8 Maturity Model. Mitigation Strategy 8: Regular Backups

What are Regular Backups?

We’ve now come to the last of Essential 8 Mitigation Strategies, regular backups.

Backups are all about recovery. If you were unable to prevent malware delivery and execution, your environment with

• Application Control,
• Patch Applications,
• Configure Microsoft Office Macros,
• and User Application Hardening,

Hopefully, you have at least limited the extent of cybersecurity incidents by

• Restricting Administrative Privileges,
• Patch Operating Systems,
• and Multifactor Authentication.

Either way, if cyber criminals have breached your environment, they can start to do damage. Some common techniques are exfiltrating your data and leaving ransomware notes or infecting your critical servers with malware crippling your systems.

In any of these cases, you could be left with no data; therefore, backups are essential, not only creating and protecting them but also testing out your business continuity plan to recover them. Unfortunately, we have seen too often organisations putting in the effort to collect and protect backups for years without ever testing them, only to find out, when they needed most, that the backups were useless when they needed it most—tough times.

This last Essential 8 Mitigation Strategy, regular backups, helps your organisation recover from a cyber incident by protecting your backups and applying least privileges and separation of duties principles to your backups.

Why are Regular Backups important?

While this is the last time we speak about users in Essential 8, it is important to continuously understand your users to best adapt backup strategies to your organisation.

👩‍💼Business users

• I backup important files on my shared drive
• I have some files I do not backup

✅Risk managers

• We should backup regularly to minimise business risk in the event of an incident
• The more we backup, the less risk

👩‍💻IT users

• We take backups of IT systems all the time
• We don’t test all our backups
• We secure our backups with X encryption techniques
• They take a lot of storage space, so we don’t store them for too long

😈Threat actors

• If I can steal data, I want as much leverage as possible to make them pay my ransomware demands.

Maturity Level 1: Regular Backups

Backups of important data, software and configuration settings are performed and retained with a frequency and retention timeframe in accordance with business continuity requirements.

Essential 8 talks about backing up your data, software, and configuration settings. If you are on-prem, it would be easy to do all three; however, if you are using services like Microsoft 365, then most backup solutions will only let you backup your data, not your configuration, so you may have to look for alternatives. 
 
Review your business continuity plan to check your backup frequency and retention timeframes to implement this. Then, look for a backup solution for your data, software, and configuration settings if you still need to start using one. 
 
Assessors will review your business continuity documentation for backup frequency requirements and retention periods.

Backups of important data, software and configuration settings are synchronised to enable restoration to a common point in time.

If your configuration, data, and software backup times are mismatched, the restoration will likely be unsuccessful. Therefore, the backup solutions must be synchronised. Otherwise, your backups may be useless.

Backups of important data, software and configuration settings are retained in a secure and resilient manner.

Backups should be encrypted, and processes and procedures to your backup must be resilient in case your backup equipment or provider fails.

If you back up yourself, then you need to secure your backups. If you are using third parties, you must check that your backups are protected and secure.

Restoration of important data, software and configuration settings from backups to a common point in time is tested as part of disaster recovery exercises.

If you’ve done your backup correctly and backed up your data, software, and configuration settings to a synchronised point, finding another environment and testing your disaster recovery process should be successful.

As we mentioned, it is essential to test your backups as you would want to avoid ending up in a situation where an incident has occurred. Your data has unfortunately been exfiltrated that you find out your backups do not work and have never worked.

Record your disaster recovery exercises, reports and lessons learnt. This requirement is for disaster recovery, meaning a significant recovery, not a business-as-usual recovery.

Unprivileged accounts cannot access backups belonging to other accounts.

Applying least privileges to backups. Admins should manage backups; unprivileged accounts shouldn’t need to touch backups, especially those belonging to other accounts.

Assessors will check backup permissions to ensure compliance.

Unprivileged accounts are prevented from modifying and deleting backups.

Since unprivileged accounts can only access their logs, this requirement intends to restrict the modification and deletion of their own backups.

Maturity Level 2: Regular Backups

Privileged accounts (excluding backup administrator accounts) cannot access backups belonging to other accounts.

At Maturity Level 2, Essential 8 extends least privilege principles on backups so privileged accounts (excluding backup admins) can now only access their own backups.

Restricting access limits, the impact of a cyber incident in the event privileged accounts are compromised to only their own backups.

Privileged accounts (excluding backup administrator accounts) are prevented from modifying and deleting backups.

As at Maturity Level 2, now privileged accounts, not just unprivileged accounts, can no longer modify nor delete their own backups.

Here we can see Essential 8 apply separation of duties to backups by splitting your privileged accounts and backup administrator accounts to limit the damage further should your environment be breached. In doing so, adversaries could not encrypt and delete your backups unless they managed to obtain access to backup admin accounts, a subset of privileged accounts.

Maturity Level 3: Regular Backups

Unprivileged accounts cannot access backups belonging to other accounts, nor their own accounts.

At Maturity Level 3, Essential 8 takes least privileges even further. Access to backups is restricted to backup admins only. Here, unprivileged accounts can no longer access their own backups.

Privileged accounts (excluding backup administrator accounts) cannot access backups belonging to other accounts, nor their own accounts.

Extending least privileges again, non-backup admin accounts can no longer access any backups, including their own.

Privileged accounts (including backup administrator accounts) are prevented from modifying and deleting backups during their retention period.

Finally, backups should not be tampered with by anyone, including backup administrators. Therefore, making backups immutable to all users, including backup admins, is the ultimate way to protect backups from compromise. Even if backup admin credentials are stolen, your data will remain intact.

Of course, you only keep your backups immutable in accordance with your organisation’s business continuity plan and its defined retention period; otherwise, the file size could be huge, not to mention the costs!

Concluding Regular Backups

Regular Backups are a short but important Mitigation Strategy.

Regular backups can be used to recover from cyber incidents. Processes, procedures, and responsibilities should be defined in our business continuity policy. Backups must be protected with encryption and access limited by applying least privilege principles and separation of duties. Finally, backups must be tested regularly, and any learnings documented.

At the end of the day, backups can save you, and while it may be an afterthought, make sure you take your backups seriously.

If you have followed all of our Essential 8 series, pat yourself on the back! It’s a great effort, and together we have made the world safer. We would love to hear from you, so please get in contact to chat about Essential 8.

Where to Next?

Regularly backup your organisation’s data! Accelerate your Essential 8 program and reach out to a CyberOxide Specialist to help uplift and assess your Essential 8 Mitigation Strategy 8: Regular Backups.

You’ve made it to the last in our Essential 8 series. If you would like to learn more, contact us about how we can help you achieve your Essential 8 goals.

Loop back to our Essential 8 series

Overview:

• Exploring the Origins and Significance of the Essential 8

8 Essential Mitigation Strategies:

1. Application Control
2. Patch Applications
3. Configure Microsoft Macros
4. User Application Hardening
5. Restrict Admin Privileges
6. Patch Operating Systems
7. Multifactor Authentication
8. Regular Backups

Adoption:

• Navigating Cybersecurity Excellence: The Essential Eight Meets Prosci's OCM Approach

Looking to accelerate your Essential Eight implementation?

Learn about our Essential 8 Accelerator or simply contact a CyberOxide specialist to find how we can help you.