How the Cybersecurity Landscape Killed Backups
85% of MSPs report ransomware attacks against their small to medium-sized business (SMB) clients, and 50% of attacks have resulted in ransomware demands exceeding $50,000. Due to the steady increase in sophistication, complexity, frequency, and consequences of cyber-attacks, backups alone are no longer enough. The changing cybersecurity landscape has state regulators and cyber insurance companies pressuring MSPs to up their security game – or face dire consequences.
What’s required now is comprehensive business continuity and disaster recovery (BCDR) to ensure business survival after an inevitable attack. A multi-layer security strategy is necessary to address the variety of environments MSPs have to protect – from endpoints to servers and workstations, as well as the cloud. To ensure you’re paid on claims, insurers require that MSPs have more than just a backup and that they have a disaster recovery plan. It is a smart idea to check with your insurer periodically to make sure your plans meet their criteria for the chain of events they want to see. You’re responsible for getting an entire organization back to long-term health while enabling near-instant recovery, managing cyber insurance forensic needs, adhering to state regulations, and fulfilling the promise of cloud economics. Backups can’t do all that, but a complete BCDR solution can.
Escalating and Targeted Threats in the Channel
Too many MSPs and their clients have grown numb to the severity and reality of today’s cybersecurity landscape. Ransomware and phishing attacks rise year over year, and human error is still the most significant cause of data loss today. Supply chain attacks, like the SolarWinds attack in December 2020, and the Kaseya attack in July 2021, targeted simple vulnerabilities that granted access to huge opportunities. Through a run-of-the-mill employee-targeted spear-phishing attack, SolarWinds compromised up to 18,000 customers. In the Kaseya attack, 2,000 organizations had their data breached through the remote computer management tool.
Thinking, ‘it won’t happen to me’ or ‘I’m not big enough to be attacked’ denies the reality of the situation. Cybercriminals target MSPs for the wealth of aggregate data they store. The U.S. Cybersecurity & Infrastructure Security Agency (CISA) put out an alert titled Advanced Persistent Threat Activity Exploiting Managed Service Providers in late 2018. The alert calls explicit attention to ongoing threats to MSP networks because of their direct and unfettered access to customer data. With such a large attack surface for cybercriminals, it’s no wonder why MSPs are targeted and often successfully attacked.
SMBs are targeted for being relatively unprotected compared to enterprises. Plus, the sheer number of attacks against SMBs is difficult, if not impossible, for law enforcement to follow up on each and every one, so less chance for the bad actors involved will be identified and punished. For hackers, the name of the game is ROI. Small attacks can be more lucrative because the attacks are easier, require less time, and are cheaper overall due to weak and easy-to-breach defenses. With a third of SMBs using free, consumer-grade cybersecurity tools, and a fifth of them having no endpoint security at all, it’s obvious why SMBs are such an easy target.
Dispersed Data Requires a New Approach to Security
Since the digital transformation went full speed ahead to accommodate COVID-19 restrictions, the role of the MSP has gotten harder. Remote-first environments force MSPs and their SMBs to rethink data access, collaboration, device protection, and disaster recovery. Now, MSPs have to support and secure hundreds of networks and ingress points while protecting employees from public WIFI risks and BYOD (Bring Your Own Device) tragedies. We’ve never seen so many organizations that are both in the cloud and supporting on-prem operations as they build flexible infrastructures for hybrid environments. Endpoint protection has never been more critical, and that requires more than just backups.
A shocking 70% of SMBs go out of business within just a year of a significant data loss incident, so you and your clients must take BCDR seriously. Instead of thinking, hoping, and crossing your fingers that it doesn’t happen to you, you should assume that it will. 40% of SMBs experienced at least 8 hours of downtime following a security breach. An incident response plan, coupled with near-instant recovery via virtualization, can substantially reduce downtime costs, ensure business continuity, save you from paying the ransom, prevent future attacks, and protect you and your client’s reputation. Relying on backups alone doesn’t take into account the full effect of the breach, including protection, detection, communication, response, and recovery.
MSPs Can Be Held Responsible for Data Loss
Historically when a breach occurs, it’s the business itself who receives blame for inadequate security. Today, blame is shifting from the targeted company to the MSP responsible for protecting business data. New government legislation in Louisiana seeks explicitly to regulate MSPs with reporting requirements and public records of cyber incidents. Texas added what some are calling a public ‘wall of shame’ where data breaches are on display for the public. New Jersey and Connecticut now require breach disclosure regardless of whether data is exposed or stolen.
Cyber insurance carriers also want MSPs to take responsibility when data goes missing. Having seen the consequences of inadequate security and disaster recovery, carriers are acting more like compliance officers, mandating specific technologies, platforms, or products – or else denying coverage. And who can blame them? With rising ransomware, targeted attacks on supply chains, MSPs, and their SMB clients, remote work, and the number of businesses allowed to forgo adequate protections – carriers are raising rates and requiring security for coverage. These new obstacles force MSPs to increase their security while requiring more from their clients. The overall effect should reduce successful cyberattacks and ensure business survival if an attack takes place.
Legacy Backups are Failing
According to a 2021 Data Protection Report, 41% of organizations report having inadequate backup and failing to meet their SLAs. Additionally, 80% of organizations say there’s a gap between their ability to recover and their need to recover. The increased focus on modern and cloud-based services has had a major impact on data protection trends for IT delivery practices. Inadequate backup and failure to meet SLAs are the two biggest challenges for MSPs today. As systems increasingly become dependent on the cloud and modern services, backup failure rates due to legacy systems are increasing.
That same report found that, on average, 37% of backup jobs had errors or could not be completed in their allocated backup window. That means, potentially, over one-third of all backups may not be restorable. The research also shows that one-third (34%) of all restorations fail to restore within the expected SLA. These statistics imply that only 63% of backups and 66% of restores will be successful with current legacy data protection. Ultimately, you’re only able to recover less than half of the time (42%).
These legacy backup tools are creating a gap between what the company thinks it can recover from and the reality of backup limitations. Legacy data protection tools are letting down clients, MSPs, consumers, and everyone who thinks backup is business continuity. There’s a misperception that even with legacy backup tools, the basics are still covered. It’s the job of MSPs to educate clients on the reality of business continuity versus backup and require clients to adequately protect their data to protect their business and protect your MSP.
Standardize With a Single Comprehensive BCDR Solution
Straight backups may be dead, but we’re not out of solutions. The channel can take control of our current cybersecurity landscape by transcending failed backups and legacy tools with a solid security-first stance. One of the biggest security threats is vendor sprawl. Eager MSPs are adding vendor after vendor to their stack in the hopes of pleasing all clients. Unfortunately, your technicians, support, sales, and marketing teams are tasked with learning another unique system with each additional vendor. When disaster strikes – and remember, it will – teams cannot restore data and recover completely to keep clients moving. Downtime increases while teams struggle to restore according to the exact vendor requirements of that solution. Today, many MSPs are spending more time managing vendors than adding value for clients.
Comprehensive BCDR eliminates the costly consequences of vendor sprawl by meeting multiple business use cases with a straightforward solution. Now, MSPs can manage endpoint backup, no-appliance BDR, turn-key BDR, and public or private cloud backup with just one vendor. Just one process for all your billing, support, onboarding, marketing, sales, and most importantly, disaster recovery. Simplifying your stack empowers your team to become masters on one solution to better service clients in times of need. Not only does standardization allow you to act swiftly and recover completely, but it saves you considerable costs. Now, your team can focus on business-building tasks rather than vendor management. With hardware-free BDR, MSPs are saving up to 55% each month without the cost of expensive hardware, onsite visits, maintenance, and stress.
Axcient x360Recover Direct-to-Cloud
Axcient is the only solutions provider that makes comprehensive BCDR possible. As the most cost-effective BCDR solution for MSPs, Axcient x360Recover is designed to simplify disaster recovery to keep business moving. Meeting all your client’s needs for appliance-based BDR, hardware-free BDR, and now with optional local cache encryption on any local storage, Axcient makes disaster recovery easy. Features like chain-free technology, AutoVerify, AirGap, Virtual Office, and Direct-to-Cloud – now with Local Cache – set Axcient apart. We update our solutions regularly to continue helping MSPs meet the changing cybersecurity landscape we’re facing.
See how much Axcient x360Recover can save your MSP and your clients, see our dynamic features first-hand, and compare it to your current solution in a free 14-day trial. Start Your 14-Day Trial Today!
Author
How well could you sleep with reliable cloud-based backups and recovery?
Take a deep dive into Axcient’s proprietary, automated security features to see how we’re ensuring uninterrupted business continuity — no matter what:
