You're securing your disaster recovery plan. How can you protect sensitive data in your systems?

D'après mon expérience, Pour protéger les données sensibles dans un plan de reprise après sinistre, je recommande le chiffrement de toutes les données sauvegardées pour éviter l'accès non autorisé. Implémenter des contr?les d'accès stricts, limitant l'accès aux données sensibles uniquement aux personnes autorisées. Faire des sauvegardes redondantes stockées hors site pour garantir la disponibilité des données en cas de sinistre local. Effectuer régulièrement des tests de reprise après sinistre pour vérifier l'efficacité des mesures de protection des données.

Encryption is essential in this day and age. Companies and institutions that neglect it from the start often pay the price in the form of data breaches and denial-of-service attacks. Such incidents can deter customers and negatively impact growth. For example, DNSSEC (Domain Name System Security Extensions) is only enabled on about 28% of the top one million domains, a hard-to-digest fact. Similarly, adopting HSTS (HTTP Strict Transport Security), current standard TLS protocols, and strong SSL ciphers is vital for the security of both companies and their customers. These changes enhance readability and ensure your points are communicated effectively.

Como alguien siempre preocupado por la seguridad, tanto personal como corporativa, creo en el equilibrio entre seguridad y disponibilidad. Uso cifrado para datos en reposo (AES) y en tránsito (SSL), garantizando que permanezcan seguros en todo momento. En las copias de seguridad, empleo un sistema de llave pública y privada, asegurando que solo se pueda acceder con la llave privada. Además, descentralizo las copias de seguridad, ya que, aunque estén encriptadas, un desastre físico como una inundación en un único servidor podría eliminar todas las copias. Esta combinación de cifrado robusto y descentralización garantiza la protección y disponibilidad de los datos ante cualquier desastre.

Of course, this is the basis and mandatory requirement. Data must be protected already in the database and at the data communication level.

It’s crucial to go beyond just managing access and encryption. Regularly conduct thorough audits of data protection measures to identify any vulnerabilities or compliance issues. Ensure that data backups are encrypted both in transit and at rest, and stored in geographically diverse locations to prevent loss from localized disasters, implement continuous monitoring and real-time alerting systems to detect and respond to any suspicious activities promptly. Training employees on data security best practices and keeping them updated on the latest threats can further help. Finally, regularly test your disaster recovery plan through simulated attacks and scenarios to ensure its effectiveness and to make necessary adjustments.

Al ser por definición desconfiado, siempre parto del principio de mínimo privilegio, y registro todos los escalados de privilegios. Esto evita que un manager otorgue más privilegios a una persona que no los necesita solo porque se lo ha pedido; siempre debe haber un motivo real. He estado experimentando con llaves de seguridad para a?adir una capa extra de protección a los equipos y aplicaciones. Actualmente estoy probando Ledger (usando tokens o NFTs) y Yubikey, con los cuales estoy gratamente satisfecho. Es importante recordar que muchos ataques cibernéticos se realizan a través de los usuarios, por lo que creo que es esencial formar adecuadamente a los empleados.

Access control restricts access to data only to authorized users. This minimizes the risk of unauthorized individuals, even if they manage to get hold of the data, from viewing or modifying it. Access control systems can be configured to set different permission levels for users. For instance, some users might have read-only access, while others might be authorized to edit or delete data. Access control systems often maintain an audit log that tracks who accessed what data and when. This log can be crucial for forensic investigations in case of a security breach.

Los controles de acceso son cruciales para limitar quién puede ver y modificar los datos confidenciales. Implementar políticas de acceso basadas en roles (RBAC) garantiza que solo el personal autorizado tenga acceso a la información sensible. Además, es importante revisar y actualizar regularmente los permisos de acceso para adaptarse a los cambios en las responsabilidades del personal y minimizar el riesgo de acceso no autorizado.

Data encryption is equally important for backups as it is for primary data. Even if your backups are stored securely, encrypting them adds an extra layer of protection in case unauthorized users gain access to the backup storage location. With encryption, even if they manage to steal the backup data, they won't be able to decrypt and access the information without the encryption key.

And make sure your backups are immutable and have an appropriate retention policy! You do not want disgruntled employees or hackers to delete or modify your backups.

Realizar copias de seguridad periódicas es una práctica vital para la recuperación ante desastres. Las copias de seguridad deben almacenarse en ubicaciones seguras y, preferiblemente, en diferentes ubicaciones geográficas para protegerse contra desastres locales. Es crucial probar regularmente las copias de seguridad para asegurarse de que los datos pueden ser restaurados de manera efectiva y rápida en caso de una pérdida de datos.

You also need to know which services are mission critical (which do you restore first) and in which order they need to be restored. And then you get to the question of a consistent state. Not all backups were taken at the exact same time, so depending on your landscape and applications, after you restore everything, in application B a transaction might already be processed, but not in application A which comes before B. This can result in an inconsistent state across your landscape and big issues, even though everything was restored properly.

Incident reports provide a detailed account of what transpired, when it happened, how it was discovered, and the action taken in response. This record keeping is essential for future reference and analysis.

Continuous monitoring in cybersecurity involves the real-time observation and analysis of an organization's IT environment to detect and respond to threats and vulnerabilities. This practice is crucial for maintaining ongoing security awareness, enabling swift incident response, and mitigating risks. By utilizing automated tools to continuously collect and analyze data from network traffic, system logs, and applications, organizations can promptly identify and address security issues. Continuous monitoring helps maintain a robust security posture, ensuring that potential threats are identified and managed before they can cause significant harm.

A todos nos da pereza revisar o crear la documentación, pero es fundamental para garantizar que todo funcione a la perfección. Las políticas cambian a menudo con la incorporación de nuevos roles, puestos de trabajo, software y procedimientos, por lo que es imprescindible que se adapten continuamente. Si no actualizamos nuestras políticas, corremos el riesgo de enfrentar problemas y tener que dar explicaciones en caso de una eventualidad. Realizar auditorías periódicas y mantenerse al tanto de las nuevas tecnologías y metodologías de seguridad es crucial para proporcionar la mejor protección posible a nuestros datos confidenciales.

Be aware that you will need more than one Strategy for recovering sensitive data. You may need to recover just one application in isolation to all others - and you will require a completely different approach if you need to recover an entire data centre. For an entire data centre you may have recover all the data before restarting any application - to avoid synchronisation issues between applications.

You can have the best backup and a working (tested) restore strategy. But if you don't know how long it will take to restore services and how much each minute/hour/day of downtime costs you, well, you don't know how much you will have to spend on your solution and if a restore will even help you.