Data protection: “Making backups impossible to compromise”

Faced with increasingly sophisticated cyberthreats, data protection has become a cornerstone of organizational resilience.

Martial Hébert, Pre-sales & IT Consultant at Anidris x Easi, discusses best practices for building a modern backup strategy and explains how Cohesity addresses them.

The first mistake is to reduce data protection to backups alone. Resilience actually relies on multiple layers of protection. You must protect not only the data itself, but also the infrastructure that hosts it and the tools that manage the backups. Indeed, if the orchestrator, from which you manage your data and its backups, goes down, you also lose your ability to restore your resources. This is a factor that should not be underestimated.

When discussing data protection strategies, the 3-2-1 rule is frequently cited. For our customers, this means having at least three copies of their data, stored on two different types of media, including one off-site copy. This approach provides protection against hardware failure, human error, as well as ransomware or a compromise of the primary site. It remains the foundation of an effective backup strategy. In particular, it helps meet the requirements set forth in the NIS2 and DORA regulations (for the financial sector), which aim to strengthen the resilience of the organizations concerned.

A backup is only valuable if it is still available and intact. This is precisely the goal of WORM (Write Once, Read Many), which makes backups immutable. Once the data is protected, it can no longer be modified or deleted. In practice, even an administrator with the highest privileges can no longer modify or delete a protected backup. Any exceptional request must go through a validation process involving multiple people, following the four- or even six-eyes principle.

This provides protection against internal threats, in particular. The goal is to make it impossible for backups to be accidentally or maliciously deleted.

Today, Cohesity platforms enable “worming” of data, whether it is stored in an external environment or on-premises.

In principle, no. For cost reasons, you should limit yourself to data that is critical to business continuity. The first step should be to classify the data. But many companies tend to consider everything critical. Without proper classification, organizations often apply the same backup policies to their entire information assets, which has a direct impact on storage and retention costs. The more frequent the backups and the longer the retention period, the greater the storage requirements.

That said, it’s clear that defining protection policies is not solely the responsibility of IT teams. Concepts such as criticality, retention periods, RPO, and RTO, which define the maximum tolerable downtime and the maximum amount of data the company is willing to lose, must be discussed with business units. They are the ones who know which data is essential to the company’s operations and which losses are truly acceptable.

Before any restoration, it is essential to ensure that the data is intact and has not already been compromised. With this in mind, we are increasingly required to set up a “Vault”, that is, a completely isolated environment, in order to restore backups, analyze them, and verify their integrity before reintegrating them into the information system.

The challenge is not solely technological. It is also essential to have robust procedures in place. Under the pressure of a cyberattack, you cannot improvise a restore. Regular tests, every three months, are essential to verify that backups are actually restorable and that everyone knows their role.

Cohesity, with its Data Protect and NetBackup solutions, brings together all the components needed for a modern data protection strategy: backup orchestration, immutable storage, WORM protection, anomaly detection, backup analytics, and access governance. This unified approach addresses the challenges of availability, integrity, and disaster recovery simultaneously, while simplifying infrastructure management.

Building on these solutions, we help companies define their data protection strategies to ensure they meet their business, regulatory, and budgetary requirements. Cohesity provides the technological building blocks. Our expertise lies in integrating them into a truly resilient architecture.