Embed Size (px)
DESCRIPTION
On World Backup Day 2014, the Data Loss Gremlins unleashed a dastardly attack on businesses worldwide! Intronis has published this Tech Guide, the 6 Ways to Fight the Data Loss Gremlins, to help IT solutions providers protect their clients from any data loss disaster.
Citation preview
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
11 00
00
20-121-205 33-650-438 50-224-768 40-643-00012-001-947 00-391-335
INTRONIS CLOUD BACKUP & RECOVERY
T E C H G U I D E
6Ways to Fight the Data Loss Gremlins
KleptoScratchMayhem Mal Whoopsie Daisy Scorch
T E C H G U I D E
Introduction Bent on annihilation, the Data Loss Gremlins thrive on the misery of business owners worldwide. They
come in many shapes and sizes – Fire, Natural Disaster, Theft, Virus, User Error, and Equipment Failure
– but their unified mission is to get their hands on critical business data at any cost.
The unfortunate reality is that these nasty threats have the upper hand over organizations that
lack the tools to protect their information.
The Disaster Recovery Preparedness Council surveyed IT representatives from 243 organizations
around the world for its 2014 Disaster Recovery Preparedness Benchmark Study, finding that 73 per-
cent would receive failing grades for disaster readiness.1
That’s a sign that businesses need help protecting their data. And it’s a call for many IT solutions
providers to take up the charge in the battle against the Data Loss Gremlins.
How can MSPs, VARs, and IT services providers win the fight? Put these seven tools to use today
when building an IT infrastructure that will help your clients protect against and recover from a visit
by the Data Loss Gremlins.
Encrypt data to keep it safe from prying eyes
Data encryption is one of the most effective IT tools available for keeping private or sensitive
information protected.
By obscuring data and requiring an encryption key to view it, organizations are better able to
prevent thieves, cybercriminals, and rogue employees from reading information that’s meant for
private eyes only.
Data can be encrypted in three states: at rest, in use, and in transit. The University of Colorado,
Boulder describes several different types of encryption solutions:
• Application encryption
• Database encryption
• E-mail encryption
• File and folder encryption
• Full disk encryption
• Network encryption2
1 “The State of Global Disaster Recovery Preparedness,” Disaster Recovery Preparedness Council, March 20142 “Types of Encryption,” University of Colorado, Boulder, October 20123 “Eight things senior managers need to know about data encryption,” Sophos, 2011
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
20-121-20533-650-438 50-224-768
12-001-947 00-391-335
’’’’’0
40-643-000
1
Klepto
2 [email protected] 800-569-0155 www.intronis.com @intronisinc
T E C H G U I D E
In addition to these solutions, security vendor Sophos describes two additional encryption options:
• Cloud application encryption
• Removable media encryption3
As an IT support provider, you should consider encryption solutions on a client-by-client basis.
For example, a client with employees who travel frequently will be better protected with a full
disk encryption solution for laptops and mobile devices. But, depending on that client’s other
circumstances, additional levels of encryption may or may not be necessary.
Healthcare clients would benefit from most, if not all, of these solutions. The Health Information
Portability and Accountability Act (HIPAA) sets strict guidelines for patient privacy adherence, so it
could benefit partners to encrypt healthcare data sent via email, stored in specific files and folders,
transmitted to cloud service vendors, and so on.
Regardless of industry, secure any wireless networks with WPA2 encryption. Open networks (and
those encrypted with WEP and WPA) are potential vectors for outside actors to get in. If WPA2 is not
available, WPA is acceptable.
Educate users on best practices for virus and malware prevention Viruses and malware have become an even more intimidating threat in recent years, partly because
those behind these attacks are sophisticated, well-trained, and well-funded.
Security vendor Kaspersky described “Advanced Persistent Threats” in a blog post, writing that in
many cases, the developers behind these attacks target corporations for access to intellectual
property.4
While most of your SMB clients might not fit the profile of the corporations these master crimi-
nals target, they could still be at risk to sophisticated threats such as Cryptolocker. Ultimately, each of
your clients needs access to trusted antimalware and antivirus software to keep them safe from the
bevy of new attacks unleashed regularly.
At the same time, antivirus and antimalware can only protect against threats that have already
been identified. To keep clients safe from new and emerging threats, MSPs must stress IT security
education basics.
Clients should be made aware of typical social engineering tactics and know not to download
attachments or click links in emails from unusual or unfamiliar senders, and to never surrender pass-
words or sensitive information over the phone or internet.
4 “All You Need to Know About APTs,” Kaspersky, November 2013
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
20-121-20533-650-438 50-224-768
12-001-947 00-391-335
’’’’’0
40-643-000
2
Mal
3 [email protected] 800-569-0155 www.intronis.com @intronisinc
T E C H G U I D E
Create BYOD security policies and protect mobile devices
Mobile devices are an increasing presence in the workplace, and IT fights an uphill battle keeping
data secure when employees introduce unchecked and unapproved technology into the corporate
network.
Rather than prohibit personal mobile devices outright – a ban that will often go ignored –
managed services providers can support SMB’s BYOD requirements with strong security policies.
With a strong framework, MSPs can reduce the chance that sensitive company data is
compromised if a worker’s mobile device is stolen or lost. Mobility management provider Fiberlink
recommends IT professionals consider a number of factors when devising a BYOD strategy, including:
• The types of devices they want to support
• Relevant compliance requirements by industry or jurisdiction
• Ways to parse out personal information so it is not collected
• Data plan management, payment, and tracking
• Options for automated and/or self-service configuration5
Ultimately, MSPs should strive for a BYOD policy that is secure, but also flexible and inclusive enough
so that it is not ignored or circumvented by their clients’ workforce.
Implement strong user access control Though user education is a helpful way to increase the security IQ of an organization as a whole, and
while BYOD policies can introduce the guidelines employees need to stay the course, MSPs should
still consider and implement a strong user access control framework.
Even in smaller businesses, very few employees need unrestricted access to all of a company’s
sensitive data and applications. Instead, MSPs can rely on user access control tools to make sure
employees only have the rights they need to do their own job – and no more than that.
This can help protect against less sophisticated worms, but more importantly, in the event of a
social engineering attack that gains access to a system, it can help to mitigate the level of intrusion
that occurs.
5 “The Ten Commandments of BYOD”, Fiberlink, retrieved March 2014
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
20-121-20533-650-438 50-224-768
12-001-947 00-391-335
’’’’’0
40-643-000
3
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
20-121-20533-650-438 50-224-768
12-001-947 00-391-335
’’’’’0
40-643-000
4
Scorch
Scratch
4 [email protected] 800-569-0155 www.intronis.com @intronisinc
T E C H G U I D E
Develop a business continuity and disaster recovery plan Protecting your clients from the Gremlins also means having a plan in place for when a disaster strikes.
Business continuity and disaster recovery (BCDR) is an increasingly critical service for the channel
as more businesses become conscious of their need to prepare for unexpected interruptions.
About 40 percent of the organizations surveyed by the Disaster Recovery Preparedness Council in
its 2014 Benchmark Study acknowledged that their existing BCDR plans were not very useful when a
disaster actually occurred.6
When developing a BCDR plan for your clients, consider a few important factors:
• Speed – Define a recovery time objective (RTO) and recovery point objective
(RPO) that meets your clients’ needs for speedy recovery
• Scope – Address the unique recovery needs of each part of the business –
certain departments may have different requirements than others
• Timespan – Set a plan for short-, medium- and long-term recovery, so your clients
have guidance every step of the way
• Granularity – Think about recovery on multiple levels – by application, by services,
and for an entire site
• Testing – Perform regular plan testing – preferably with automated tools – and be sure to
apply your test results to improve your BCDR plan
Use off-site cloud backup so you can recover the business
A business recovery solution driven by cloud backup is an effective way to put your clients back
on their feet after a disaster. By sending data off-site in any fashion, MSPs are able to ensure that a
backup is available in the event that a local disaster knocks out a client’s main place of business.
One advantage of using cloud backup over physical backup solutions like tape is that cloud
backup can be automated. As a result, consistent, reliable backups are taken as often as a client
needs, and an economical backup solution makes storing this data off-site cost-effective for any small
business.
MSPs looking for a cloud backup solution should seek one that is secure, efficient, and robust.
Military-grade data encryption can keep a client’s data safe while in transit and at rest. Dual-coast
data centers ensure that even if a backup in one location is compromised, an additional copy is avail-
able for a restore. And change-block tracking technology makes cloud backup economical by updat-
ing only the portions of data that have been most recently changed.
6 Disaster Recovery Preparedness Council, March 2014
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
20-121-20533-650-438 50-224-768
12-001-947 00-391-335
’’’’’0
40-643-000
5
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
1’0”
0
2’0”
3’0”
4’0”
5’0”
20-121-20533-650-438 50-224-768
12-001-947 00-391-335
’’’’’0
40-643-000
6
Mayhem
Whoopsie Daisy
5 [email protected] 800-569-0155 www.intronis.com @intronisinc
A B O U T I N T R O N I S
T E C H G U I D E
On the Web: www.intronis.comIntronis Cloud Backup and Recovery Blog: blog.intronis.comSocial Channels: @IntronisInc | Facebook: intronisonlinebackup | LinkedIn: Intronis
Intronis is an award-winning provider of world-class cloud backup solutions exclusively for the IT channel. Intronis offers the deepest Exchange and SQL backup on the market, securely protects physical and virtual data with native support for VMware, Hyper-V, and physical system images, and easily integrates with top RMM and PSA tools. Intronis’ com-plete data protection platform has been field tested by thousands of MSPs and is centrally managed from a single console that can be customized and rebranded. In 2014, the com-pany was recognized as a “Best Channel Vendor” by Business Solutions Magazine and one of the “Top 100 Cloud Computing Vendors” and “Top 20 Coolest Cloud Storage Vendors” by CRN Magazine. Learn more at www.intronis.com. To learn more about the Data Loss Gremlins visit www.intronis.com/gremlins.
Finally, cloud backup enables a wider range of data protection, allowing MSPs to back up physical
system images, Exchange environments, SQL databases, and VMware and Hyper-V virtual machines.
With a complete cloud backup solution, MSPs offer complete business recovery. It’s an ideal tool
to keep your clients operational even if they are paid an unwelcome visit by any of the Data Loss
Gremlins.
Conclusion The Data Loss Gremlins come in many shapes and sizes, and when they strike, they can put any
business on the ropes. But with the help of a well-prepared and proactive IT services provider,
organizations can fight back and protect their data from these significant threats.
By taking the above steps, you can put your IT services business in a better position to support
your clients through any interruption, and implement the tools and resources needed to head off
preventable disruptions.
Beat the Gremlins!
CLICK TO CONTACT
Contact Intronis to learn more about our business recovery solution
6 [email protected] 800-569-0155 www.intronis.com @intronisinc
