What CISA’s September 2023 Ransomware Guide Says About Offline, Encrypted, Tested Backups

The 3-2-1 rule sets a baseline for a small business backup plan: three copies of important data, on two kinds of storage, with one copy kept off site. Backblaze describes the rule the same way and calls it more of a starting point than a complete solution. The rule is simple to state. The harder questions are which copy sits in the cloud, which copy stays out of reach of the network, and how a team confirms that a restore works before it needs one.

CISA’s #StopRansomware Guide, in its September 2023 edition, puts the weight on offline copies. The guide updates a joint CISA and MS-ISAC ransomware guide released in September 2020. Cloud storage and immutable copies do other jobs, and each has limits that the sources below describe.

Three Copies, Two Media Types, One Off-Site Copy

The 3-2-1 rule asks for three copies of important data: the working copy and two backups. Backblaze says the rule means three total copies, stored on two kinds of media, with one copy off site. The two backups should sit on two different kinds of storage, so that one failure does not remove both. One of the three copies must be kept off site, away from the building where theft or a natural disaster could reach it.

Backblaze says the media requirement now refers to two separate devices, because cloud providers handle the physical storage. Its example is a computer, an external drive and a cloud backup, which it presents as a complete 3-2-1 setup.

The rule sets the count, the variety of media and the location.

Backblaze dates the rule to the late 2000s and cites a 2012 Carnegie Mellon publication prepared for US-CERT that recommended the method.

CISA’s Offline Backup Advice
CISA’s #StopRansomware Guide, in its September 2023 edition, asks organisations to keep offline, encrypted backups of critical data and to test their availability and integrity.

Why the Offline Copy Matters Under Ransomware

CISA’s #StopRansomware Guide advises keeping offline, encrypted backups of critical data and testing them for availability and integrity in a disaster-recovery scenario. The reason given is that many ransomware variants search for accessible backups and then delete or encrypt them. A backup that an attacker can reach is a backup the attacker may be able to destroy.

The guide also says to back up often, either offline or cloud to cloud. Restores should reconnect systems from offline, encrypted backups, starting with the critical services that matter most. Staff should take care not to reinfect clean systems during recovery.

For rebuilding, the guide advises keeping backups of template files offline so resources can be redeployed quickly. The guide also recommends maintaining and regularly updating golden images of critical systems. It also says to retain backup hardware for rebuilding systems when rebuilding the primary system is not preferred.

The guide notes that older hardware can present installation or compatibility hurdles when a system is rebuilt from an image.

What Immutable Cloud Copies Change

Amazon’s S3 Object Lock is one way to make a cloud copy hard to change. It works only in buckets with versioning enabled, and it uses a write-once-read-many (WORM) model to store objects. A retention period or a legal hold stops the protected object version from being overwritten or deleted. Retention periods and legal holds do not prevent new versions of the object from being created, or delete markers from being added on top of it.

AWS describes two retention modes. In compliance mode, no user can overwrite or delete a protected version or shorten its period, including the root user of the AWS account. AWS says the only way to delete such an object early is to delete the associated AWS account.

In governance mode, users with the s3:BypassGovernanceRetention permission can still remove protected objects, and the request must also include a specific bypass header. A legal hold has no expiry date and stays in place until an authorised user removes it. It is independent of any retention period, so an object with both stays protected after the retention period ends, until the hold is removed.

AWS describes variable retention as a way to set a configurable recovery window against ransomware or accidental deletion. While the event hold is on, the object stays protected. When the hold is released, Amazon S3 sets the retain-until-date to the release time plus the event hold duration.

CISA’s guide adds a caution that immutable storage does not meet compliance criteria for certain regulations, and that misconfiguration can impose significant cost. The same guide says to enable delete protection or object lock on storage that ransomware could target, and to consider version control for recovery from unintended or malicious changes.

How Often to Test a Restore

CISA’s guide asks organisations to test backup procedures on a regular basis and to test backup availability and integrity in a disaster-recovery scenario. It sets no fixed interval.

A restore test checks two separate things. The first is the availability of the backup. The second is its integrity.

The guide’s wording places these tests in a disaster-recovery scenario. Because the guide asks for both availability and integrity to be tested, a test that checks only one of the two does not cover both.

A backup that an attacker can reach is a backup the attacker may be able to destroy.

What Cloud Copies Cost for a Team Under 20

Backblaze lists B2 pay-as-you-go storage at $6.95 per TB per month, billed monthly on average data stored. At that rate, 1 TB costs $83.40 a year, 2 TB costs $166.80 and 5 TB costs $417 a year in storage charges alone. Backblaze also lists annual commitments of one to five years.

Backblaze says download traffic is free up to three times the average amount stored each month, and beyond that allowance it charges $0.01 per GB. For a 2 TB copy, that allowance covers up to 6 TB of downloads a month. Its page lists free Class A, B and C API calls for pay-as-you-go customers. Class D calls cost $0.004 per 10,000, and the first 2,500 each day are free.

Backblaze’s higher-throughput Overdrive tier starts at $15 per TB per month and includes unlimited free egress, but it requires a multi-petabyte commitment. The storage figures in this section exclude egress and API charges, as well as offline media.

For cloud-to-cloud copies, the guide suggests considering a multi-cloud solution to avoid vendor lock-in.

Backups Held by a Managed Provider

CISA’s guide also covers outside providers. If a managed service provider maintains a business’s backups, the guide says the business should ensure the provider follows the applicable best practices. It also recommends contract language to formalise security requirements.