Imagine this: you arrive at the office only to discover that ransomware has locked up your systems. You think you're safe because you have your backups, only to find out that your backups are also encrypted — or even worse, deleted.
HOW IS THIS POSSIBLE?
Attackers deliberately target your backups to render them unusable. They do this in three ways:
🔸 by deleting your backup
🔸 by encrypting your backup
🔸 by modifying your backup so that when you restore it, you have the wrong data
WORM AS PROTECTION
So how do we protect ourselves from this threat? Enter WORM. WORM stands for "Write Once, Read Many." It's the concept of immutable storage. Immutable means you cannot change it.
The idea behind it is that if you take your backup and place it in immutable storage — meaning you write it once, and then it can no longer be touched, changed, or altered in any way, shape, or form — your data remains protected. Modifying your backup would result in a new version, while your original remains intact.
WORM is a very important part of any data protection strategy. Having immutable backup is not just about compliance. It's also about 𝗧𝗥𝗨𝗦𝗧:
Can you really trust your backups? Can you really trust that data — such as sensitive customer information, financial information, and intellectual property — remains intact, so that when the time comes and you have to restore your backup, the data is still the same?
Or do you run the risk that it has been tampered with?
SO WHAT?
So having WORM and immutable storage is not just about security and compliance, but also about trusting the authenticity and the veracity of the data. And so here's the real challenge: is WORM part of your data protection strategy today? Has it been implemented in a way that actually does the job? Are your backups stored immutably? Are they protected from accidental deletion?
👉 If not, make WORM part of your data protection strategy today. Implement immutable storage to ensure your backups remain safe and secure.
Stay sharp,
Jetro
PS: Here's the NIST CSF 2.0 reference to this topic: PR.DS-11 (PROTECT: Data Security). And CyFun: PR.IP-4 (PROTECT: Information Protection Processes and Procedures).
🔔 My goal is to help as many European organizations as possible turn their fragmented cybersecurity into well-governed cyber resilience.
Here’s how I usually help:
🔸 Fractional CISO services
🔸 Cyber risk assessments
🔸 Certified training
🔸 Keynotes
👉 Want to talk? Reach me at: ciso@bluedragonsecurity.com :: +32 495 81 47 41 (WhatsApp OK)
Share this post