Data is living in more places than ever before, with workloads frequently shifting between on-premises and the cloud. Hybrid IT infrastructures and a proliferation of data and devices not only make it more expensive, complex and time-consuming to manage, but the data is also under constant attack from cybercriminals. Employees can pose a further risk if they accidentally delete or change data.

Research from Forrester illustrates the size of the problem. While over half (52%) of workloads in small and medium-sizes businesses (SMB) are running in the public cloud today, nearly three quarters of SMBs say their organization does not have the capability or capacity to train and upskill their employees as the cloud grows in complexity.

Ransomware attacks are also growing, making it even harder for businesses to keep their data secure. According to a report by Astra, there are now an estimated 19 attempted ransomware attacks every second. Most attacks include attempts to infect data backups, too, leaving many organizations with no choice but to pay the ransom, or risk data loss, reputational damage, financial losses and more.

Backups have always been the last line of defense against ransomware and other attacks – even more so in the face of rising cyber threats. In fact, dozens of global compliance frameworks already mandate backups, and compliance requirements are only increasing.

Hybrid systems create backup sprawl

A reliable, failsafe data protection and disaster recovery strategy should therefore be an organization’s first security investment. But, as attacks continue to surge, businesses are struggling to defend their increasingly complex hybrid infrastructures. Protecting business data wherever it is – across physical servers, mobile devices, SaaS platforms, remote users, collaboration tools and the cloud – may now require solutions from as many as nine or more vendors, as businesses have more environments to back up and need more tools to make this happen.

For example, these could include components from backup software vendors, server hardware manufacturers, hypervisor vendors, operating system vendors, storage and cloud storage vendors, PC backup and SaaS backup vendors – the list goes on.

Unfortunately, sometimes, a rush to implement new cloud services or enable remote access means that data performance takes priority over security considerations, leaving risky security gaps. Organizations may also fall into the trap of opting for cheaper backup solutions to cover each of their data environments, but being cost conscious on the front end often results in a more expensive solution that requires additional systems, infrastructure and administration time.

And, when it comes to cloud services, many businesses wrongly believe the cloud provider has their backup fully covered, when this is often not the case. Most Infrastructure-as-a-Service (IaaS) providers do not offer the storage of historical data or full data protection and recovery out of the box; their terms and conditions state that this is the responsibility of the cloud customer. Moreover, when cloud data is compromised or there is an outage or account lock, backups that are hosted in the same place as the original data will also be affected. To avoid getting caught out, cloud customers must put in place additional data protection measures that meet their own requirements in terms of recovery times and recovery points.

Getting the backup strategy right

To avoid backup sprawl and reduce the administrative burden, organizations should look for a single solution that allows them to create multiple backups of all their data, no matter where it is saved or processed. The first step is a careful audit to understand where the business data resides and how it is currently backed up. Ideally, the backup platform should cover on-premises servers, end devices, SaaS solutions and the public cloud. This makes backup processes more efficient and manageable, while giving better visibility across the entire organization.

Backups should always be immutable, meaning they can’t be changed. They must be verified for integrity and tested for usability – and stored in separate safe locations to avoid the risk of the backup files becoming infected.

Businesses also need to ensure their backup and recovery strategy covers all of the key recovery scenarios – from users losing files to system outages to ransomware attacks. Most organizations will need the ability to spin up a new production environment in case of an outage or cyber incident, to avoid costly downtime.

The cost of creating and managing backups is another important factor. ‘As-a-service’ backup solutions are usually more cost effective and the spend will be more predictable. And finally, as workloads keep switching between on-premises and the cloud, the backup solution must be adaptable enough to evolve with changing needs.

Ultimately, all businesses, no matter their size or industry, are at risk of ransomware and infected backups. Hackers don’t discriminate, so organizations need to assume they are always at risk and they must be prepared. Backups are an essential security tool, but in the age of hybrid infrastructures and remote working, a one-backup strategy is no longer enough. Only a flexible multi-backup strategy that covers the entire IT environment will reliably protect business data from both accidents and attacks.