Menu

disaster recovery

supply chain and cybersecurity part 2

Safeguarding the Digital Fortress: Navigating Cybersecurity and Supply Chain Challenges – Part 2

, , , , , , , , , , , , , , , , , , , , , , , ,

This is the second part of a 2-part series wherein we explore cybersecurity and supply chain challenges. In the first post, we explored the challenges, risks, and threats that cybersecurity and the supply chain pose to organizations and how these could be effectively mitigated against. We also looked at how cybersecurity supply chain risks touch nearly all facets of business operations including sourcing, vendor management, supply chain continuity and quality, transportation security and many other functions across the enterprise.

The digital landscape is fraught with diverse cybersecurity threats, ranging from malware and phishing attacks to the ever-looming threat of ransomware. Such threats not only compromise data integrity but also disrupt operations and tarnish the reputation of businesses. In this second and final part of the series, we’ll delve even further into a few other factors that play into the complex yet critical fabric of the global interconnectedness of businesses and organizations. Let’s get started, shall we?

A holistic approach to C-SCRM

Cybersecurity and the supply chain are interdependent and mutually influential. C-SCRM is a vital process that helps organizations to ensure the security and integrity of their products and services and to mitigate the risks and threats that may affect their supply chain.

To be effective, C-SCRM must be seen and conducted as an enterprise-wide activity that involves all tiers of your organization i.e., people, business processes, and technology. C-SCRM requires a holistic and proactive approach that involves collaboration among all parties in the supply chain and incorporates other aspects of cybersecurity such as generative AI, data protection, leadership, cyber resilience, privacy, third-party risks, and cybersecurity governance.

Generative AI for C-SCRM

The emergence of Generative AI, a subset of Artificial Intelligence (AI), has brought new possibilities for enhancing cybersecurity. Generative AI can be a powerful tool for C-SCRM in several ways, such as:

  1. Enhancing the security and quality of products and services by using generative AI to test, verify, or validate their functionality, performance, or compliance.

  2. Improving the efficiency and agility of supply chain processes by using generative AI to automate, optimize, or streamline tasks such as design, development, distribution, deployment, maintenance, etc.

  3. Increasing the innovation and differentiation of products and services by using generative AI to generate new features, functionalities, or designs that meet customer needs or expectations.

  4. Enabling the personalization and customization of products and services by using generative AI to tailor them to specific preferences, contexts, or scenarios of customers or users.

However, there are some challenges and risks of integrating Generative AI into C-SCRM, such as:

  1. Introducing new vulnerabilities or threats to products and services by using generative AI to create malicious or harmful content or data that can compromise their security or integrity.

  2. Reducing the transparency or accountability of products and services by using generative AI to generate content or data that is difficult to explain, verify, or trace.

  3. Increasing the complexity or uncertainty of products and services by using generative AI to generate content or data that is dynamic, unpredictable, or probabilistic.

  4. Affecting the ethics or legality of products and services by using generative AI to generate content or data that is inappropriate, offensive, deceptive, or infringing.

Therefore, it is important to use generative AI responsibly and ethically for C-SCRM and ensure that it complies with the relevant standards, regulations, and best practices.

A reinforced and sturdy C-SCRM

C-SCRM is not a standalone activity but rather an integral part of the overall cybersecurity strategy and culture of an organization. Therefore, it’s essential to incorporate other key aspects of cybersecurity such as data protection, leadership, cyber resilience, privacy, third-party risks, and cybersecurity governance into C-SCRM. Some of the ways to do this include:

  1. Data protection: Ensure that the data that is collected, processed, stored, transmitted, or shared in the supply chain is protected from unauthorized access, use, disclosure, modification, or destruction. Implement data protection measures such as encryption, authentication, authorization, backup, recovery, etc. Comply with data protection laws and regulations such as GDPR, CCPA, etc.

  2. Leadership: Establish a clear vision and direction for C-SCRM that is communicated and supported by the top management and stakeholders. Empower and enable the C-SCRM team with the necessary resources, authority, and accountability. Foster a culture of trust, collaboration, and continuous improvement among all parties in the supply chain.

  3. Cyber resilience: Build the ability to anticipate, prepare for, respond to, and recover from cyberattacks in the supply chain. Develop a cyber resilience strategy that covers prevention, detection, response, recovery, and learning. Implement cyber resilience measures such as redundancy, diversity, modularity, adaptability, etc.

  4. Privacy: Privacy is a complex and evolving domain that requires balance and trade-offs. It’s subject to various interests and values that may conflict or compete with each other. Respect the rights and preferences of customers and users regarding their personal information in the supply chain. Implement privacy measures such as consent, notice, choice, access, rectification, erasure, etc. Comply with privacy laws and regulations such as GDPR, CCPA, etc.

    Your organization can implement privacy standards and frameworks (e.g., ISO/IEC 29100, NIST SP 800-53A, or CIS Privacy Controls) that provide guidance on how to embed privacy principles and practices into its data processing activities.

  5. Third-party risks: Third-party risk management is subject to various sources and types of risks that may change or evolve over time. Some examples of such sources and types of risks include performance risks, financial risks, operational risks, strategic risks, compliance risks, or reputational risks. Assess and manage the risks associated with the external parties that provide products or services in the supply chain. Implement third-party risk management measures such as due diligence, risk assessment, contract management, monitoring, auditing, etc.

    Your organization can comply with third-party risk management standards and frameworks such as ISO 27036 (parts 1 through 4), NIST SP 800-161, etc.

  6. Cybersecurity governance: Cybersecurity governance is a challenging and demanding domain that requires leadership, culture, and competence. Cybersecurity governance is subject to various stakeholders and expectations that may vary by sector, industry, or region. Some examples of such stakeholders and viewpoints include board members, senior managers, employees, customers, suppliers, regulators, and auditors. Establish and maintain the policies, processes, structures, roles, and responsibilities for C-SCRM. Implement cybersecurity governance measures such as planning, organizing, directing, controlling, reporting, etc.

    Your organization can implement cybersecurity governance standards and frameworks such as ISO 27001, ISO 38500, NIST SP 800-37, NIST CSF, COBIT, etc. Your organization can also invest in cybersecurity governance tools to help enhance its cybersecurity governance capabilities and performance. Such tools and training include cybersecurity governance dashboard, cybersecurity governance scorecard, cybersecurity governance maturity model, cybersecurity governance workshop, etc.

NIST has outlined some key practices for effective C-SCRM alignment including:

  1. Integrate C-SCRM across the organization.

  2. Establish a formal C-SCRM program.

  3. Know and manage critical suppliers.

  4. Understand the organization’s supply chain.

  5. Closely collaborate with key suppliers.

  6. Include key suppliers in resilience and improvement activities.

  7. Assess and monitor throughout the supplier relationship.

  8. Plan for the full lifecycle.

Experts on cybersecurity and supply chain management like to draw attention to the fact that operating systems are only as strong as their “weakest link“. The “weakest link” argument is evoked with good reason when discussing risk management.

— Xeneta

Conclusion

Okay, we’ve discussed the challenges and opportunities of cybersecurity and supply chain management. We’ve also discussed how Generative AI can be used to create and protect data in various domains. Finally, I’ve provided some best practices and recommendations for improving cybersecurity and supply chain management, drawing on relevant guidance and regulations such as the NCSC Supply Chain Security Guidance, the NIST CSCRM, and the EU Supply Chain Due Diligence Directive.

If you are interested in learning more about C-SCRM or need help with implementing it in your organization, please contact me today. I can help you to design, develop, and deploy a C-SCRM strategy that suits your business objectives, risk appetite, regulatory obligations, and cybersecurity posture. I can also help you to leverage generative AI for C-SCRM responsibly and ethically.

Hasta que nos encontremos de nuevo; take care, see you around soon.

Why Cyber Kill Chain not Sufficient to Protect Your Organization

Why The Cyber Kill Chain Is Not Sufficient to Effectively Protect Your Organization

, , , , , , , , , , , , , , , ,

An epochal shift during the 21st century has led us to enter a new era of technological advancements, where cyber security has become vital in keeping an organization and business secure.

The rise of computers, telecommunications and the internet had opened the doors for cyberterrorism. Cyberattacks had become so rampant that they started to become a threat to the economy. Cybercriminals and hackers have also evolved their digital skills in stealing and destroying other businesses by breaching information security.

Having an effective security system to protect your organization is your best defense against cybersecurity threats. It does not only protect your business but your consumers and employees as well.

Investing in an efficient cybersecurity plan promotes risk management for monetary and reputational damage and ensures data integrity and confidentiality within your organization.

Ignoring cybersecurity is a grieve and an expensive mistake to make. Though it may not eliminate the risk of cyberattacks, a layered security approach can withstand cyber intrusion and assaults.

Lockheed Martin Cyber Kill Chain Framework

The Cyber Kill Chain is a stage-based framework (or methodology, if you like) originally developed by Lockheed Martin which traces the stages of cyberattacks. An adaptation of an established military defense operation, it is a part of their Intelligence Driven Defense Model that identifies vulnerabilities and prevent cyber intrusion activities.

This framework is named “Kill Chain” as it was adapted from a military term related to an attack’s structure. By stopping the attacker at any stage during the assault can break the chain of attack! The adversary must completely advance through all the stages to succeed. Each stage of intrusion will give us the chance to know more about the attacker and use their tenacity as our leverage.

The Kill Chain Framework works in 7 stages:

  1. Reconnaissance – The step where the targets are identified. Adversaries plans and research their target organizations. These intruders will use automated scanners to find weak points in the system. They could scan firewalls to create a point of entry in the system. Detecting the intruders during reconnaissance could be challenging, but it could help reveal the attackers’ criminal intents.

  2. Weaponization – The adversaries start staging their operation. After finding security vulnerabilities in the system, these attackers will develop malware. If their target is document-based, they produce a “decoy” file to present to the victim. They weaponize malware based on the attack’s intention. This is also the stage where adversaries could find ways to reduce their chances of being detected. The defender will not detect weaponization as it happens, but they can figure out the intent by investigating malware artifacts.

  3. Delivery – The adversaries start to launch their operations. The attackers will start sending the malware to the defenders. They will deliver the weapon through email phishing or a removable/portable device. This is a vital stage for the defenders. Blocking the operation should be prioritized at this point. This can be done if the delivery medium is analyzed or targeted servers are detected.

  4. Exploitation – Advancing to this stage is when the attackers start to gain access to their victims. The malicious malware was delivered and breached the secured parameter. Opening a phishing email attachment or clicking on a malicious link has triggered the “zero-day”, a phrase that refers to the exploit code. At this rate, custom capabilities are crucial to stop zero-day exploits. But traditional hardening measures could also help in adding resiliency to the security.

  5. Installation – The hacker, had already established a beachhead at the victim. The malware has installed a backdoor that will serve as a point of entry for the intruder. Some adversaries would ensure that the malware looks like a regular part of the installed operating system. In this stage, it is important to stop the attack by using systems such as the Host-Based Intrusion Prevention System (HIPS). It can alert or block common installation paths.

  6. Command and Control (C2) – The adversaries gain control of the system’s network. The malware has opened a channel of command to remotely manipulate the victim. They can gain access to secure and confidential accounts and could attempt damaging attacks. This stage is the defender’s last chance to block the attack. And this can be done by blocking the C2 channel. This will stop the adversaries from issuing a command to prevent further damage.

  7. Action on Objectives – The adversaries have reached their goals-the stage where the hackers have successfully extracted their needed data from the system. They gained the power to damage further, such as collecting user credentials, destroying the system, or overwriting and corrupting the data. The longer the hacker has access to CKC7, the greater the impact of the damage. This stage could be detected as soon as possible using forensic evidence and network packet capture.

cyber kill chain model

Key Elements of the Cyber Kill Chain:

The Cyber Kills chain was designed to assist companies in developing in-depth strategies for defense. By mapping out the steps that the hackers take to complete a cyberattack, organizations would be able to combat persistent cyber threats.

Since the Cyber Kill was derived from a military model, the main elements of this framework are established to identify adversaries, prepare for an attack, engage, and destroy a target. It can quickly identify and recognize social engineering, insider threats and innovative attacks.

Drawbacks of Kill Chain Framework

The Cyber kill chain is modelled to respond to pre-determined attack sequences. It has been universally adopted for cybersecurity. But like any other model, it is not perfect and has its fundamental flaws.

  1. The model assumes a perimeter focus defense where the main resistance is a firewall. It fails to cover other internal attacks and cyberattack vector paths.

  2. Cyber Kill Chain framework’s phase sequence cannot precisely block all attacks. Most of its phases can be easily bypassed.

  3. The framework only focuses on blocking an attack but fails to define what to do after the adversaries successfully breaches the system.

  4. Once the adversary was able to penetrate the victim’s system, the framework’s timing of the attack in every phase was inconsistent. Adversaries could easily stay dormant for a longer period while they wait for the opportunity to launch their final phase of attack without being detected.

Teams that say their cybersecurity is really good are the ones to worry about. After our breach, the most difficult issue was deciding when it was safe enough to come back online. I learned that really smart engineers can talk English, under extreme pressure.

— Dame Dido Harding, former CEO of TalkTalk

Other Frameworks with Similar Objectives Compared to the Cyber Kill Chain

MITRE ATT&CK vs Cyber Kill Chain

ATT&CK is an acronym that stands for Tactics, Techniques, and Common Knowledge.

The MITRE ATT&CK framework was designed based on observations in the real world. It reflects the different phases of an intruder’s attack lifecycle and the target platforms.

One could argue that there are Cyber Kill Chain and MITRE ATT&CK both share common views and understanding of cyberattacks i.e., most cyberattacks involve adversaries breaking into networks, avoiding getting detected, stealing as much data as they possibly can, interrupting as much network operations as they possibly can, getting out as quietly and stealthily as they got in, making hidden backdoor access available if they ever need to return, etc.

However, compared to Cyber Kill Chain, the Mitre ATT&CK framework maintains a matrix model that has more in-depth details on how the adversary will attack in each stage. Also, Cyber Kill Chain fail to factor in the different techniques and tactics of a cloud-native attack.

The Cyber Kill assumes that the attackers will deliver malware to a target environment but ATT&CK assumes that the adversaries may very well change their goals/objectives mid-way through an attack especially when the success of the attack appears either easier or more difficult than they had initially planned.

Yes, one could argue that the MITRE ATT&CK framework uses Situational Crime Prevention (SCP) techniques, a set of techniques which assumes that the goals/objectives of most adversaries are not linear but influenced/informed by opportunities, constraints, limitations, resistance, and situations presented to them by their targets during the execution of attacks.

Google BeyondCorp vs Cyber Kill Chain

BeyondCorp is an implementation of a zero-trust security concept that creates a zero-trust network. Designed to provide end-to-end real-time protection and platform security. It has embedded data built into the Chrome browser to prevent malware infection from networks and provide phishing-resistant authentication.

Unlike the Cyber Kill Chain framework, Google BeyondCorp “shifts access control from the traditional network perimeter to individual devices”. Its zero-trust access approach users to securely work with untrusted networks even if they are not using a client-side VPN.

NIST Cyber Security Framework (NIST CSF)

The National Institute for Standards & Technology (NIST) Cyber Security Framework (CSF) provides a set of structured standards and measurements for cybersecurity. The framework sets out “standards, guidelines, and best practices to manage cybersecurity-related risks.”

But the downside of the framework is that its 5 categories/elements i.e., Protect, Identify, Detect, Respond and Recover; fail to directly outline how it can dissect a cyberattack incident. It also fails to supply analytic markers to test the detection.

Nevertheless, the descriptive (and not prescriptive) nature of the NIST CSF has made it seem “business-friendly” and therefore, made it possible for the framework to be adopted by businesses and organizations of all sizes and across several industries, particularly organizations in industries that are guided by regulary controls and compliance requirements where industry-uniqueness and specificities are considered important.

data breach

In conclusion, there is no one defense framework or set of techniques that could be considered all-in-one sufficient for all cybersecurity defense requirements.

In a previous article, I had looked at how the proposed Digital Operational Resilience Act (DORA) could impact businesses and organizations once ratified and signed into law.

Given the significant penalties that would be imposed for non-compliance with DORA directives, it is perhaps reasonable to envisage that DORA could eventually have similar, if not greater, impacts in both the UK and the EU region as did GDPR, albeit with very different objectives.

Whilst some of these defense techniques may excel in certain aspects of information security, many of them are complimentary to each other and bring different or much enriched strengths to the conversation.

 

8 ways to manage business disruptions caused by coronavirus outbreak

8 Key Ways to Manage Business Disruptions Caused by Coronavirus Outbreak

, , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

Coronavirus; also known as COVID-19; reached a critical phase outside China, impacting the worldwide population and economic environment. The virus has spread in several countries and regions of the world, outside China, with devastating effects.

The World Health Organisation (WHO) recently stated that Europe is now the epicentre of the COVID-19 pandemic as very high and increasing numbers of cases of the deadly coronavirus are reported in Italy, Spain, and neighbouring countries.

According to WHO, more than 140 countries, regions, and territories have reported cases of the coronavirus. And whilst the number of reported new cases in China is falling, it is rapidly increasing in Italy, Spain and some other European countries.

As at Monday, March 16 2020; these were the official figures reported in several countries:

  • In Italy, over 27,000 people tested positive for the coronavirus, with 2,158 deaths
  • In Spain, over 9,900 people tested positive for the virus, with 342 deaths
  • Whereas in France, over 6,600 people tested positive for the virus, with 148 deaths
  • For the USA, over 4,700 people tested positive for the coronavirus, with 86 deaths
  • And in the UK, over 1,500 people tested positive for the virus, with 55 deaths

Governments of several countries across the world are taking extraordinary measures to combat the pandemic, including shutting down schools, restricting public movement and gathering, postponing sports events, and even imposing border controls in their respective countries.

After the coronavirus, nothing will be as before, we will have to sit down and rewrite the rules of trade and the free market.

COVID-19 has been ruled as a significant impact on businesses from all sectors, and businesses & organisations should understand, learn, and immediately provide appropriate & adequate response, to ensure business continuity. The global financial losses resulting from the impacts of the virus is estimated to be approximately US$2.7 trillion.

Virgin Atlantic recently asked its staff to take eight weeks of unpaid leave over the next three months, to help the airline cope during the coronavirus pandemic. The warning comes after many countries around the world closed borders or placed extensive restriction measures on arrivals.

With the outbreak of COVID-19, the potential of business disruptions is very significant. Businesses and organisations need to ensure that potential and possibly inevitable risks associated with pandemic are well factored into their business continuity and disaster recovery plans, as well as their incident response plan.

The coronavirus pandemic is very most likely already causing disruptions to business operations, and could affect contract performance.

Companies have to think on their feet and have crisis meetings, twice, sometimes three times a week just to try and keep up with the changes in government regulations and what they have to do to try and manage the situation.

— Dr. Adrian Hyzler

 

In a previous post, I’d written about how much time is generally required to conduct a risk assessment. We’d all agree that, given the current full-blown stage of the coronavirus pandemic, most businesses and organisations would have gone past risk assessment phase, and now in the phase wherein appropriate controls and measures are implemented and followed through.

With such a dynamic situation like COVID-19, it has the potential to be as disruptive, or more, to an organisation’s continuity of operations as a cyber intrusion or natural disaster

— Sandy Shen, Senior Research Director, Gartner

 

Let’s look at some ways that your business or organisation can manage and limit the impacts of coronavirus pandemic on your business operations and functions:

  1. Communicate frequently with your team

    It is imperative in these times to communicate with your staff. They might get concerned about their health and how they will continue to work as the situation worsen.

    You have to communicate with your staff informed news about the evolution of COVID-19.You must both formally and informally direct your staff to follow relevant directives and guidance provided by governments and health authorities regarding the matter, including how to improve and maintain good personal hygiene levels.

    Business leaders, department heads, and team leads should respond promptly to questions raised by staff and colleagues. You provide direct responses to their questions, escalate the questions to senior staff, or you could simply point them in the direction of more reliable, trustworthy, and accurate sources relating to the questions asked.

  2. Encourage remote working

    Several businesses and organisations require their sales team, support team, technical team, and senior executives to travel and visit customers locations across several regions and even countries; these teams are generally the lifeline of these businesses.

    On top of that, nearly all businesses and organisations have locations that several staff are required to be physically present at during business hours.

    In these times, however, you’d need to ensure that your staff can perform their daily tasks efficiently from remote locations like their respective homes. You may need to invest in internal communication systems or secure corporate Virtual Private Networks (VPN), to allow your staff to do their jobs from these remote locations from home.

    following guidance on very good personal hygiene

    Staff members who do not feel well, whose daily tasks do not require physical presence in business locations, or whose commute to work locations exposes them to potentially high-risk areas should be encouraged to work from appropriate remote locations.

    The National Institute of Standards and Technology (NIST) has a special publication on telework security that you may find useful on this very matter.

    Following these steps would help your business and organisation to avoid a possible epidemy that could affect all your staff and cause severe business disruptions.

  3. Create a disaster recovery policy

    A disaster recovery policy will normally help improve the resilience of any business to unforeseen incidents or force majeure, including outbreak of diseases like the coronavirus. You should define your worst-case scenario and prepare adequately for it. You should take into consideration all aspects of your business, and all associated risks and severity of potential impacts on these.

    And as usual, your disaster recovery plan, business continuity plan, and incident response plan should all include your communication plan, RACI matrix, and all necessary information how to keep your business going.

  4. Sort out contingency planning

    All businesses and organisations; at this moment; would be expected to already have standards, backup plans, policies, and measures in place to address potential risks associated with the coronavirus pandemic.

    Such controls and measures are expected to describe the ways your business and organisation will respond in the unlikely event of incidents like the coronavirus pandemic.

    You would be expected to have conducted a business impact analysis, which will identify and prioritize the information system and the critical components to support your business operations and functions. The exercise would also help your business and organisation to identify measures that must be taken to reduce the effects of system disruptions and create contingency strategies that will ensure that your business will recover quickly from the incident.

    Every senior executive, department head, and team leader should have a clear role assigned, and should know what to do at every stage of the contingency plan. The actions should be specified very clearly and understood very well by your team.

  5. Be prepared to adapt your plan to current situations

    The global coronavirus pandemic could be described as uncharted waters for several generations. Consequently, it is almost very difficult to anticipate the course of events that will happen due to coronavirus evolution.

    So, you shouldn’t be concerned or afraid to revise or modify plans whenever the prevailing situation takes a different turn (for better or worse), and you’d realised that your plan or any parts thereof is no longer particularly fit for purpose.

    Be ready to adapt, improve, and communicate!

    This means that you should keep yourself well informed, and be ready to modify your plan as and when events require such modification. History suggests that you could do more wrong if you don’t take necessary actions that demonstrate your ability to improve and improvise if and when necessary. Be ready to revise your plans and communicate with your staff the reasons and grounds for these changes.

  6. Stabilise the supply chain

    Several severe disruptions appeared in the supply chains due to shut down of nearly all factories in China. If your business is affected by these disruptions, you may want to research into finding new suppliers from different countries or regions, to help improve the resilience of your supply chain.

    Perhaps more importantly, your business or organisation should research into how to effectively manage your supply chain for products that may register very unusually high spikes in demand during crisis times, if your organisation has any vested interest in such products.

  7. Respond to your customers’ new demands

    There are good chances that this crisis would will most probably cause a shift in your customers’ behaviour.

    The recovery from a coronavirus-triggered recession will usher in a new era in which how we live, do business and invest will fundamentally change.

    — Nigel Green, CEO, deVere Group

    Researches have shown that businesses and organisations that manage disruptions better generally do very well. The key reason attributed to such good results was the investment, time, and efforts committed by these businesses and organisations to their core customer segments and anticipation of their customers’ behaviours.

    To effectively anticipate and address customers’ changing behaviours, businesses and organisations are encouraged to invest in digital online platforms as part of their strategies for multi-channel distribution network.

  8. Make sure that you have sufficient working-capital

    For several businesses and organisations, expressing optimism about rebuilding and rapid recovery following critical disruptions and prolonged downturn to business operations and functions may be rather very challenging.

    The disruption and shifts will underscore that we live in a time of great capabilities and great promise.

    But to build and protect their wealth as the world adapts to a new era, investors should be revising their portfolios to mitigate risk and take advantage of the opportunities.

    — Nigel Green, CEO, deVere Group

    Knowing where, when, and how to get the right level of badly needed investment into your business or organisation could be the key differentiator in the next cycle of business post-coronavirus.

    It’s very heart-warming to know that several financial institutions; like Barclays, NatWest, and the European Bank for Reconstruction and Development (EBRD); have announced emergency financing packages that they have respectively made available to businesses and organisations affected by the coronavirus pandemic.

awesome remote working

In conclusion, the rather disturbing and disruptive global outbreak of the coronavirus could potentially have several unexpected severe consequences and implications on our lives, businesses, and how we get on with everyday tasks and thought process.

But rest assured, some great outcomes from all the mess are yet still very possible.

In order for any business or organisation to hope, anticipate and look forward to great outcomes, therefore, its senior executives, leaders, and key decision makers should not assume the worst outcomes but yet be adequately prepared for the worst nevertheless; by putting in place effective plans, measures, controls, and policies that will help ensure strong business continuity the post-coronavirus pandemic.

3-2-1 backup rule and effective cybersecurity strategy

The 3-2-1 Backup Rule and Effective Cybersecurity Strategy

, , , , , , , , , , , , , , , , , , , , , , , ,

Last week, I wrote an article on top cyber security risk trends and predictions for 2020.

In the article, I reviewed some very significant breaches and attacks that occurred in 2019, touched on common cyber risks, threats, and attacks, and made predictions on what we should expect for 2020.

An interesting conversation kicked off amongst some security professionals on an online professional networking platform a few days. The conversation centred on the 3-2-1 backup rule, and how strategy measures or compares to assessing and preparing for cybersecurity threats & attacks for 2020.

The one question that seemed to pop-out of the conversation is this: Is the 3-2-1 backup rule sufficient enough to constitute or be considered as an effective cybersecurity strategy?

I’ll give my response to this question in the course of this article. But for now, let’s have a bit more contexts, definitions, and discussions on several bits of the subject, shall we?

3-2-1 backup rule diagram
3-2-1 backup rule diagram

What’s the 3-2-1 Backup Rule?

The 3-2-1 backup rule is a best practice data backup strategy that aims to ensure that data is adequately protected and resilient to potential damage and corruption.

The rule states that there should be at least three (3) copies of the data, store two (2) copies on different storage media, and keep one (1) of these copies in an offsite/remote location.

You’d notice, from the image above, that the title on the image states the 3-2-1 Backup Rule but the image appears to suggest that the rule should be called the 3-2-1-0 Backup Rule instead.

A few alternative postulations in the community state that the proper and correct best backup practice strategy should include a step that covers valid and verified data recoverability.

I do agree with the views I’d just cited above, and, thus, I felt the need to capture the 3-2-1-0 steps as also representing the 3-2-1 backup rule.

Anyway, moving on…

Yes of course! Data backup and restore are essential elements of any security strategy that’s worth its weight in salt. Absolutely. Without any doubt.

Every effective Business Continuity and Disaster Recovery (BC/DR) plan needs a very good backup strategy to be successful. The 3-2-1 backup rule is effectively all about redundancy, ensuring data resilience and availability.

As stated by Alex Mayer, “the 3-2-1 backup rule is a good recommended start in building any data protection system – a way to protect your data from loss/corruption…”

Consequently, I think we should be very clear about one thing: the 3-2-1 data backup rule is not a panacea for cyber security risks, threats, and attacks.

If your organisation (or one of your clients) had experienced any previous yet successful security attacks, you would learn that data backup is indeed a vital risk mitigating action but:

  1. It does not address or mitigate against potential severe interruptions to business operations (i.e. BC/DR, BAU, MTTR, etc.)
  2. It does not address or mitigate against attacks that target networks and infrastructure
  3. It does not address or mitigate against attacks that make illegal and unauthorised copies of data
  4. It does not address confidentiality or integrity of data nor information; 2 of 3 principles of the cybersecurity triad
  5. It does not address, resolve, or eliminate actors of the attack (both internal & external), and invariably,
  6. It does not eliminate, thwart, or deter/discourage the repeat of the (previously successful) attack or similar attacks.

I can affirm that combating and winning any cyberwarfare against cybersecurity risks, threats, & attacks requires more than implementing the 3-2-1 backup rule.

So, here’s my response to the question raised earlier on: the 3-2-1 backup rule should form a vital part of any good Security Incident and Event Management (SIEM) plan. But it is probably most certainly not a replacement or a substitute for an effective cybersecurity strategy.

Back To Top
Management Wire

ManagementWire © 2015-2025. All rights reserved.

Terms of Use

Privacy Policy

Cookie Policy

Contact