Skip to main content

Scenario S-011 - Loss of Backups

ElementDescription
Scenario IDS-011
Target assetBackup Storage (VMs, containers, databases)
Threat sourceSystem failure, human error, or malicious insider
Attack vectorFailure of backup process, accidental deletion, or corruption of backup media
Potential impactInability to restore critical systems and data after incidents, leading to operational disruption and data loss
Likelihood🟧 Medium - backup failures and human errors are common, but proper monitoring reduces probability
Impact rating🟥 High - loss of backups can result in extended downtime and permanent data loss
Risk rating🟥 High

Mitigation:

  • Implement automated backup verification and integrity checks.
  • Maintain offsite or cloud-based redundant backups.
  • Apply strict access controls and RBAC for backup management.
  • Document and test restoration procedures regularly.
  • Encrypt backups to prevent tampering or unauthorized access.

Owners:

  • Ops - backup process management, restoration testing, and access control.
  • Sec - encryption, monitoring, and alerting on backup failures.

References:

  • ISO 27001 - Control 8.6 Capacity management.
  • ISO 27001 - Control 8.17 Information backup.
  • NIST CSF - PR.IP Protective technology.
  • NIST CSF - PR.DS Data Security.
  • EBIOS RM - Identification of backup assets and risk of data loss.

Response actions:

  • Containment - Stop further backup operations to prevent propagation of errors.
  • Investigation - Identify cause of failure or deletion.
  • Recovery - Restore from remaining redundant backup copies or cloud archives.
  • Post-incident - Update backup procedures, verify integrity of all backup sets, and reinforce monitoring and access controls.