{"id":5968,"date":"2023-09-08T17:19:20","date_gmt":"2023-09-08T21:19:20","guid":{"rendered":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/?p=5968"},"modified":"2023-09-08T17:19:34","modified_gmt":"2023-09-08T21:19:34","slug":"the-cisos-guide-to-storage-backup-cyber-resiliency","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/","title":{"rendered":"The CISOs Guide to Storage & Backup Cyber Resiliency"},"content":{"rendered":"

\"\"<\/p>\n

Solutions Review\u2019s <\/strong><\/i>Contributed Content Series<\/u><\/strong><\/i><\/a> is a collection of contributed articles written by thought leaders in enterprise technology. In this feature, Continuity<\/a>‘s CTO Doron Pinhas offers<\/strong><\/i><\/span><\/p>\n

CISOs rely on information from across the organization about security, particularly from the various IT departments. Unfortunately, the information being fed to CISOs about the state of cybersecurity risk is incomplete. There is a blind spot present \u2013 a gaping hole. Data about the security posture of their storage and backup systems is either woefully deficient or missing entirely.<\/p>\n

That is one of the reasons why CISOs set strategy and approve the procurement of solutions to keep data and systems safe, yet the organization continues to suffer from breaches and attacks. Despite implementing vulnerability management, extended detection and response (XDR), threat monitoring, security information and event management (SIEM), and other technologies, they always seem to be one step behind the cybercriminal fraternity. That state of affairs is likely to remain until the inherent risk posed by vulnerable storage and backup systems is addressed.<\/p>\n

\t\t\t

<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/span><\/p>\n

CISO Guide to Storage & Backup<\/strong><\/h2>\n

False Sense of Security <\/strong><\/h3>\n

Part of the problem is that storage and backup systems are thought of as back-end and don\u2019t pose the same level of risk as other layers of IT closer on the perimeter. This can lull storage admins, infrastructure managers, and CISOs into a false sense of security.<\/p>\n

This is a misconception, and a dangerous one at that. The average enterprise storage device has around 15 vulnerabilities or security misconfigurations. Of these, three are considered a high or critical risk. Therefore, it is vitally important that CISOs understand the magnitude of the threat posed by insecure storage and backup systems and what they need to do about it.<\/p>\n

Earlier this year, we interviewed 8 CISOs to get their insights on new data protection methods and the importance of securing storage & backup, including:\u00a0John Meakin,\u00a0Former CISO at GlaxoSmithKline and Deutsche Bank,\u00a0Joel Fulton,\u00a0Former CISO at Symantec and Splunk,\u00a0Endr\u00e9 Jarraux Walls,\u00a0CISO at Customers Bank, and\u00a0George Eapen,\u00a0Group CIO (and former CISO) at Petrofac.<\/p>\n

Using the Wrong Tools <\/strong><\/h3>\n

There are scores of vulnerability scanners, patch management, and configuration management systems in existence. Organizations rely on them to locate areas of potential weakness, remediate them, and deploy patches to resolve known vulnerabilities. These systems do a great job at inventorying and scanning networks, operating systems (OSes) and enterprise applications. But they are typically sketchy when it comes to inventorying and assessing storage and backup issues.<\/p>\n

Shockingly, they often miss security misconfigurations and Common Vulnerability and Exposures (CVEs) on popular storage systems from the likes of Dell EMC, NetApp, or Pure, and backup systems from the likes of Veeam, Rubrik, and Veritas. Yet such systems host the crown jewels of enterprise data.<\/p>\n

Superficial scans of storage and backup infrastructure can lead CISOs to believe that these systems lie outside the reach of cybercriminals. Nothing could be further from the truth. Hackers are notorious for finding ways to obtain privileges to user accounts and finding their way into storage and backup systems. From there, they can wreak havoc.<\/p>\n

The State of Storage and Backup Vulnerabilities <\/strong><\/h3>\n

The fact is that hundreds of active security misconfigurations and CVEs currently exist in various storage and backup systems. Our research shows that on average, about 20% of storage devices are currently exposed. That means they are wide open to attack from ransomware and other forms of malware.<\/p>\n

A study of enterprise storage devices<\/a> detected more than 6,000 discrete storage vulnerabilities, backup misconfigurations, and other security issues. At the device level, the average storage device is riddled with vulnerabilities, some of them severe. In addition, there are currently about 70 CVEs in storage environments that could be used to exfiltrate files, initiate denial-of-service attacks, take ownership of files, and block devices. Many of these CVEs are several months old. A few of them are a year or more old. This means that approved patches exist but are not deployed.<\/p>\n

Don\u2019t think the bad guys aren\u2019t awareness of this. They prefer the easiest possible route into the enterprise. Why come up with a genius plan to broach defenses when all you need to do is scan for some common vulnerabilities and mount an incursion from there?<\/p>\n

Storage Security Features Not Implemented <\/strong><\/h3>\n

Modern storage devices often include ransomware detection and prevention capabilities. Some include the capability to lock retained copies, protect critical data from tampering and deletion, and air gap data. However, in breach after breach, such features were found to either be misconfigured or not implemented at all – leaving the organization exposed.<\/p>\n

Misconfigured backup and storage systems impacts cybersecurity in other ways. Zoning and masking mistakes may leave LUNs accessible to unintended hosts. Replicated copies and snapshots may not be properly secured. Audit logging misconfigurations make it more difficult for the organization to detect brute force attacks and spot anomalous behavior patterns. They can also impede forensic investigation and curtail recovery efforts. And a surprising number of storage and backup systems still operate with their original default administrative passwords. These factory settings can be easily exploited by unauthorized employees and malicious actors to inflict serious damage.<\/p>\n

These are just a few of the many security challenges that are present within enterprise infrastructure. There are many other areas to check. The bottom line is that storage and backup systems\u00a0generally have a significantly weaker security posture than the compute and network infrastructure layers. It is a ticking time bomb ripe for exploitation by criminal gangs.<\/p>\n

How to Harden Storage and Backup Security <\/strong><\/h3>\n

Storage and backup systems must be fully secured to protect data and ensure recoverability. StorageGuard<\/a> finds the security risks that other vulnerability management tools miss. Developed specifically for storage and backup systems, its automated risk detection engines check for thousands of possible security misconfigurations and vulnerabilities at the storage system and backup system level that might pose a security threat to enterprises data. It analyzes block, object, and IP storage systems, SAN\/NAS, storage management servers, storage appliances, virtual SAN, storage networking switches, data protection appliances, storage virtualization systems, and backup devices.<\/p>\n

Continuity\u2019s StorageGuard ensures these systems will never be the weakest link in cybersecurity. Its comprehensive approach to the scanning of storage and backup systems offers complete visibility into blind spots, automatically prioritizing the most urgent risks, and remediating them.<\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Solutions Review\u2019s Contributed Content Series is a collection of contributed articles written by thought leaders in enterprise technology. In this feature, Continuity‘s CTO Doron Pinhas offers CISOs rely on information from across the organization about security, particularly from the various IT departments. Unfortunately, the information being fed to CISOs about the state of cybersecurity risk […]<\/p>\n","protected":false},"author":385,"featured_media":6134,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[1257,1256],"acf":[],"yoast_head":"\nThe CISOs Guide to Storage & Backup Cyber Resiliency - Best Backup and Disaster Recovery Tools, Software, Solutions & Vendors<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Doron Pinhas\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/\",\"url\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/\",\"name\":\"The CISOs Guide to Storage & Backup Cyber Resiliency - Best Backup and Disaster Recovery Tools, Software, Solutions & Vendors\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2023\/07\/CISO-Guide-to-Storage-Backup.jpg\",\"datePublished\":\"2023-09-08T21:19:20+00:00\",\"dateModified\":\"2023-09-08T21:19:34+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#\/schema\/person\/2ab2c030695abeb7a0ed3270b017b021\"},\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2023\/07\/CISO-Guide-to-Storage-Backup.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2023\/07\/CISO-Guide-to-Storage-Backup.jpg\",\"width\":800,\"height\":400},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The CISOs Guide to Storage & Backup Cyber Resiliency\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#website\",\"url\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/\",\"name\":\"Best Backup and Disaster Recovery Tools, Software, Solutions & Vendors\",\"description\":\"Solutions Review\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#\/schema\/person\/2ab2c030695abeb7a0ed3270b017b021\",\"name\":\"Doron Pinhas\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/99ff13ad77dbeda186f610e46f06dba9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/99ff13ad77dbeda186f610e46f06dba9?s=96&d=mm&r=g\",\"caption\":\"Doron Pinhas\"},\"description\":\"Doron is an avid Storage and Backup security advocate, and one of the two authors of the recently published NIST special publication titled: \u201cSecurity Guidelines for Storage Infrastructure\u201d. Alongside continuous research of storage security, threat landscape, and market maturity analysis, he is also engaged in writing, public speaking and information exchanged with leading organizations.\",\"url\":\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/author\/dpinhas\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The CISOs Guide to Storage & Backup Cyber Resiliency - Best Backup and Disaster Recovery Tools, Software, Solutions & Vendors","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/","twitter_misc":{"Written by":"Doron Pinhas","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/","url":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/","name":"The CISOs Guide to Storage & Backup Cyber Resiliency - Best Backup and Disaster Recovery Tools, Software, Solutions & Vendors","isPartOf":{"@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2023\/07\/CISO-Guide-to-Storage-Backup.jpg","datePublished":"2023-09-08T21:19:20+00:00","dateModified":"2023-09-08T21:19:34+00:00","author":{"@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#\/schema\/person\/2ab2c030695abeb7a0ed3270b017b021"},"breadcrumb":{"@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/#primaryimage","url":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2023\/07\/CISO-Guide-to-Storage-Backup.jpg","contentUrl":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2023\/07\/CISO-Guide-to-Storage-Backup.jpg","width":800,"height":400},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/the-cisos-guide-to-storage-backup-cyber-resiliency\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/"},{"@type":"ListItem","position":2,"name":"The CISOs Guide to Storage & Backup Cyber Resiliency"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#website","url":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/","name":"Best Backup and Disaster Recovery Tools, Software, Solutions & Vendors","description":"Solutions Review","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#\/schema\/person\/2ab2c030695abeb7a0ed3270b017b021","name":"Doron Pinhas","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/99ff13ad77dbeda186f610e46f06dba9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/99ff13ad77dbeda186f610e46f06dba9?s=96&d=mm&r=g","caption":"Doron Pinhas"},"description":"Doron is an avid Storage and Backup security advocate, and one of the two authors of the recently published NIST special publication titled: \u201cSecurity Guidelines for Storage Infrastructure\u201d. Alongside continuous research of storage security, threat landscape, and market maturity analysis, he is also engaged in writing, public speaking and information exchanged with leading organizations.","url":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/author\/dpinhas\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/posts\/5968"}],"collection":[{"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/users\/385"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/comments?post=5968"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/posts\/5968\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/media\/6134"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/media?parent=5968"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/categories?post=5968"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/backup-disaster-recovery\/wp-json\/wp\/v2\/tags?post=5968"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}