Redefining Backup in a Hostile Environment
Historically, backups were devised for operational failures: a file gets deleted accidentally, some hardware fails, a database gets corrupted. The idea was that a backup would be a good and trustworthy environment and that having a recent version was safe enough. Cyber resiliency changes that assumption. It posits that the environment is hostile, not friendly, and builds recovery accordingly.
This necessitates changing the architecture of data protection. We move from isolated silos of backup data to immutable storage with rigorous access controls, completely separating the management and production planes and vaulting them off-site in a controlled manner. The recovery process must occur in an isolated clean-room environment where data is first restored, scanned, and validated before re-entering production. Backups evolve from “having a copy of the data” to “having a copy of the data we can prove is good under attack.”
|
Manjunath Prasad, Head of IT and CISO at TVS Mobility |
Hemanand Gadgil, Product Manager for Storage Solutions Engineering at IBM |
|
From Detection to Clean Recovery
In a resilient architecture, detection and recovery are distinct but tightly linked. A low-confidence anomaly is an alert to investigate. A high-confidence ransomware or destruction event is a trigger to isolate affected systems, assess which snapshots are likely clean and invoke a formal recovery runbook.
Clean recovery is not a point-in-time copy. It is a declared state backed by validation. Data needs to be scanned for malicious content, its integrity verified, and confirmed untouched before it re-enters the production line. The scan would occur in a disconnected, restricted environment, secured by careful authentication and exclusive administrator logins. Application logs must be reviewed for unauthorised changes, and data integrity checks must run on a regular cadence, not just during incidents.
Prasad stresses three critical components: “One is the access control to the data storage, second is the regular malware scanning of that particular data, and the third is the data integrity verification, regular verification.”
Gadgil explains how this changes the workflow: “In traditional backup, I know which version to recover, assuming it’s a clean copy. In cyber resiliency, you must identify and detect the threat, then make a clean copy, and while restoring, ensure you are restoring a clean copy. You have to scan it and make sure that it is always clean.”
Avoiding False Comfort in Immutability and AI
Although immutability copies have been widely hyped as a ransomware protection strategy, real-world use reveals gaps leading to false security. These gaps are due to incorrect retention policies, where attackers simply wait for the immutability window to expire, the existence of service accounts with unnecessary access, or retaining accounts past the necessary window, or poor control over off-site vaulting. Perhaps most dangerous is keeping the management plane, production plane and immutable copies on the same network, which allows lateral movement once any one layer is compromised. Using immutable snapshots for non-production testing can also expose them to unnecessary risk.
Gadgil warns against a common architectural mistake: “Generally, people keep the management plane and the production plane, and the immutable copy, on the same network or in the same place, which is a big pitfall, as the management and production both are on the same plane; one must have been compromised.”
At the same time, AI workloads are reshaping data priorities. AI models and training datasets may need retention for days or weeks, not hours, with stricter RPO and RTO requirements. Data classification itself is changing, as every dataset in an AI pipeline carries different risk and value. Security measures and integrity checks must be part of an AI model lifecycle from the very beginning. With respect to recovery, it’s best to first recover a small but essential subset of AI data, then validate its correctness and then apply it to large data sets.
Prasad highlights how this changes the mindset. “In the modern AI era, data classification itself goes through a lot of changes. Every data set is in a different combination altogether. So data classification is very critical now to handle the AI era.”
Advocating a practical recovery rhythm, he says, “Rather than restoring the whole database and then realizing it’s not doable, it’s better to follow the tiered approach so that we go step by step, validate a smaller set of the data, and then ensure it’s the right data. And then go for the complete data restoration.”
The Bottom Line for Technology Leaders
When attackers assume your backups are reachable, your defence must assume they are compromised. Cyber resilience is the discipline that lets you recover anyway. This means integrating data security from the design phase, protecting isolated recovery environments and regularly testing tiered recovery against real-world attack scenarios. CIOs and CISOs will eventually be measured not by whether their back-ups have successfully completed each day, but by whether trusted, usable data and services can be returned post-breach.
The way forward for organizations is to move from “backup and hope” to “assume breach, recover clean.”
