CIS Control 11: Data Recovery

Data loss can be a consequence of a variety of factors from malicious ransomware to hardware failures and even natural disasters. Regardless of the reason for data loss, we need to be able to restore our data. A data recovery plan begins with prioritizing our data, protecting it while it is being stored, and having a plan to recover data.

Key Takeaways for Control 11

Prioritize your data and come up with a data recovery plan.
Protect your backed up data. (See Control 3: Data Protection.)
Practice and Test restoring your data.
Restore your data after any compromise.

Availability of data is part of the triad of cybersecurity—Confidentiality, Integrity, and Availability. We should be able to recover data in an event of data loss but should also be able to recover if we have lost data integrity which may be the case after a security breach with unknown impacts on the system.

Safeguards for Control 11

1. Establish and Maintain a Data Recovery Process

Description: Establish and maintain a data recovery process. In the process, address the scope of data recovery activities, recovery prioritization, and the security of backup data. Review and update documentation annually or when significant enterprise changes occur that could impact this Safeguard

Notes: Document your plan that includes what is being backed up, how it is protected, and how it will be recovered

2. Perform Automated Backups

Description: Perform automated backups of in-scope enterprise assets. Run backups weekly, or more frequently, based on the sensitivity of the data.

Note: Classifying your data can help you determine how often it needs to be backed up.

3. Protect Recovery Data

Description: Protect recovery data with equivalent controls to the original data. Reference encryption or data separation based on requirements.

Notes: See Control 3 Data Protection and treat your backups like you would the original data

3. Establish and Maintain an Isolated Instance of Recovery Data

Description: Establish and maintain an isolated instance of recovery data. Example implementations include version controlling backup destinations through offline, cloud, and/or off-site systems or services.

Notes: Offline backups are very important for situations like ransomware and other malicious software and offsite backups are important for disaster recovery. “Offline” backups mean the backup is not accessible via a network connection.

Test Data Recovery

Description: Test backup recovery quarterly, or more frequently, for a sampling of in-scope enterprise assets.

Notes: This often-overlooked part of a Data Recovery plan cannot be overstated. Having quality software and hardware for Data Recovery is all for naught if you do not have the skills and experience to use them. Backups for mission critical infrastructure should be tested on a regular basis. This isn’t just to verify the integrity of the backups. It also ensures that staff has the know-how and experience to restore in a timely matter, as well.

See how simple and effective security controls can create a framework that helps you protect your organization and data from known cyber-attack vectors by downloading this guide here.

German Agencies Warn of Signal Phishing Targeting Politicians, Military, Journalists

China-Linked DKnife AitM Framework Targets Routers for Traffic Hijacking, Malware Delivery

CISA Orders Removal of Unsupported Edge Devices to Reduce Federal Network Risk

Asian State-Backed Group TGR-STA-1030 Breaches 70 Government, Infrastructure Entities

How Samsung Knox Helps Stop Your Network Security Breach

Compromised dYdX npm and PyPI Packages Deliver Wallet Stealers and RAT Malware