Ransomware Recovery Failures Expose Gaps in Immutable Backup Protections
A recent survey by research firm Omdia reveals critical vulnerabilities in enterprise backup strategies, despite widespread claims of "immutable" storage. The study, which polled 700 organizations with 1,000+ employees, found that while 75% of respondents describe their primary backup solutions as immutable, 83% of that group acknowledged at least one flaw that could allow data alteration or deletion. Common weaknesses included delayed immutability, insufficient access controls, and configurations permitting privileged users to modify protected backups.
The distinction between immutable and absolutely immutable storage emerged as a key concern. Only 16% of organizations reported achieving absolute immutability where backups remain unalterable even if attackers compromise IT credentials. The consequences of these gaps are severe: 81% of respondents experienced ransomware attacks disrupting services in the past two years (up from 66% in 2024), with 75% suffering multiple incidents. Recovery rates have plummeted, with just 39% restoring at least 75% of data after an attack, down from 57% in 2024.
Attackers increasingly target backup infrastructure, exacerbating operational disruptions. 76% of organizations lost more data than their recovery point objectives (RPOs) permitted during their worst incident, while nearly two-thirds exceeded their recovery time objectives (RTOs). The longest outages now stretch beyond five business days for 61% of respondents, compared to 51% in 2024. These failures translate into tangible business harm: 87% of affected organizations reported at least moderate damage from their most disruptive attack.
Awareness of these risks is growing. After learning the difference between standard and absolute immutability, 73% of business leaders expressed a preference for vendors offering stronger protections. However, challenges persist in vendor transparency: 89% of respondents believe immutability claims require independent verification, yet only 56% conduct third-party testing.
While half of IT leaders plan to upgrade backup storage during their next refresh cycle, many may wait years unless a cyberattack compromises their existing systems. The survey underscores that ransomware’s impact extends beyond data loss, often evolving into prolonged operational crises affecting customers, employees, and partners. Despite years of investment in cybersecurity, organizations continue to struggle with reliable recovery, leaving them vulnerable to escalating threats.
Source: https://www.channeldive.com/news/ransomware-risks-rise-backup-storage-fails-object-first/829695/
Omdia cybersecurity rating report: https://www.rankiteo.com/company/omdia
"id": "OMD1791465081",
"linkid": "omdia",
"type": "Ransomware",
"date": "1/2024",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '700 organizations surveyed',
'size': '1,000+ employees',
'type': 'Organizations'}],
'data_breach': {'type_of_data_compromised': 'Backup data, enterprise storage '
'data'},
'description': 'A recent survey by research firm Omdia reveals critical '
'vulnerabilities in enterprise backup strategies, despite '
"widespread claims of 'immutable' storage. The study found "
'that while 75% of respondents describe their primary backup '
'solutions as immutable, 83% of that group acknowledged at '
'least one flaw that could allow data alteration or deletion. '
'Common weaknesses included delayed immutability, insufficient '
'access controls, and configurations permitting privileged '
'users to modify protected backups. Attackers increasingly '
'target backup infrastructure, leading to prolonged '
'operational disruptions and data loss.',
'impact': {'data_compromised': 'Backup data alteration/deletion, data loss '
'exceeding recovery point objectives (RPOs)',
'downtime': 'Longest outages beyond five business days for 61% of '
'respondents',
'operational_impact': 'Prolonged operational crises affecting '
'customers, employees, and partners; 87% '
'reported at least moderate damage from most '
'disruptive attack',
'systems_affected': 'Backup infrastructure, enterprise storage '
'systems'},
'initial_access_broker': {'high_value_targets': 'Backup infrastructure'},
'lessons_learned': 'Critical gaps exist in immutable backup protections, '
'including delayed immutability, insufficient access '
'controls, and privileged user vulnerabilities. Absolute '
'immutability is rare, and attackers increasingly target '
'backup infrastructure. Recovery rates have declined, and '
'operational disruptions are prolonged.',
'post_incident_analysis': {'corrective_actions': ['Upgrade to absolute '
'immutable backup solutions',
'Implement independent '
'verification of '
'immutability claims',
'Enhance access controls '
'and configurations',
'Accelerate backup storage '
'refresh cycles'],
'root_causes': ['Flaws in immutable backup '
'protections (delayed '
'immutability, insufficient access '
'controls, privileged user '
'modifications)',
'Lack of absolute immutability in '
'backup systems',
'Insufficient third-party '
'verification of immutability '
'claims']},
'recommendations': ['Achieve absolute immutability where backups remain '
'unalterable even if IT credentials are compromised',
'Conduct independent verification of immutability claims',
'Upgrade backup storage with stronger protections',
'Improve access controls and configurations to prevent '
'privileged user modifications',
'Plan for faster refresh cycles of backup systems'],
'references': [{'source': 'Omdia Survey'}],
'response': {'recovery_measures': '39% restored at least 75% of data after an '
'attack (down from 57% in 2024)',
'remediation_measures': 'Planned upgrades to backup storage '
'during next refresh cycle',
'third_party_assistance': '56% conduct third-party testing for '
'immutability claims'},
'title': 'Ransomware Recovery Failures Expose Gaps in Immutable Backup '
'Protections',
'type': 'Ransomware',
'vulnerability_exploited': 'Flaws in immutable backup protections (delayed '
'immutability, insufficient access controls, '
'privileged user modifications)'}