Scenario S-011 - Loss of Backups
| Element | Description |
|---|---|
| Scenario ID | S-011 |
| Target asset | Backup Storage (VMs, containers, databases) |
| Threat source | System failure, human error, or malicious insider |
| Attack vector | Failure of backup process, accidental deletion, or corruption of backup media |
| Potential impact | Inability to restore critical systems and data after incidents, leading to operational disruption and data loss |
| Likelihood | 🟧 Medium - backup failures and human errors are common, but proper monitoring reduces probability |
| Impact rating | 🟥 High - loss of backups can result in extended downtime and permanent data loss |
| Risk rating | 🟥 High |
Mitigation:
- Implement automated backup verification and integrity checks.
- Maintain offsite or cloud-based redundant backups.
- Apply strict access controls and RBAC for backup management.
- Document and test restoration procedures regularly.
- Encrypt backups to prevent tampering or unauthorized access.
Owners:
- Ops - backup process management, restoration testing, and access control.
- Sec - encryption, monitoring, and alerting on backup failures.
References:
- ISO 27001 - Control 8.6 Capacity management.
- ISO 27001 - Control 8.17 Information backup.
- NIST CSF - PR.IP Protective technology.
- NIST CSF - PR.DS Data Security.
- EBIOS RM - Identification of backup assets and risk of data loss.
Response actions:
- Containment - Stop further backup operations to prevent propagation of errors.
- Investigation - Identify cause of failure or deletion.
- Recovery - Restore from remaining redundant backup copies or cloud archives.
- Post-incident - Update backup procedures, verify integrity of all backup sets, and reinforce monitoring and access controls.