World Backup Day: Why Backups Fail and What to Do About It
Backups are supposed to be your safety net, but they fail more often than you think. This World Backup Day , it's time to stop trusting backups blindly and start making them work when it really matters. From ransomware threats to recovery delays, here's why backups fail and how to stay prepared.
Backups are supposed to be the ultimate safety net, a last line of defense against data loss caused by cyberattacks, accidental deletions, or hardware failures. But here's the uncomfortable truth: backups fail. More often than you'd expect. And when they do, the consequences can be catastrophic.
The problem isn't that businesses don't back up their data, most do. The problem is that they assume those backups will work when disaster strikes. According to Veeam's 2023 Data Protection Trends Report, nearly 21% of all enterprise recovery attempts fail due to corrupted or incomplete backupsv. The message is clear: just having backups isn't enough anymore.
Edwin Weijdema, Field CTO EMEA at Veeam Software, sums it up perfectly: 'Fourteen years ago when World Backup Day was started, the aim was awareness. But these days, the focus should instead be on preparedness. Having backups in place and being well prepared to use them during a crisis are different things. Today should be a reminder to stress-test your backups and their accompanying data recovery plans.'
Why Backups Fail, And What's Changing
One of the biggest culprits behind backup failures is blind trust in automation. Many organizations assume that because their backup software reports a 'successful' job, everything is fine. But without regular testing, they're operating on faith, not facts. Human error also plays a major role, misconfigurations, skipped directories, or improper retention policies can silently break your backups.
And even if you get the technical part right, there's the growing threat of ransomware. Attackers no longer stop at encrypting primary data, they go straight for your backups.
According to Alain Penel, Vice President of Middle East, Turkey and CIS at Fortinet: 'Backups are a prime target for ransomware actors. Simply having backups is not enough; you need to protect them as cyber criminals adopt more sophisticated methods. Organizations must make foundational changes to the frequency, location, and security of their backups to effectively deal with evolving ransomware risks.'
Immutable backups, which cannot be modified or deleted, even by an administrator, are now essential. This ensures your data is safe, even if your entire system is compromised.
Michael Cade, Global Field CTO at Veeam Software, emphasizes this point: 'Backups need to level up to match these threats. Immutable backups need to be the standard, keeping them tamper-proof, even when under attack. And while backups are vital, organizations can't just rely on them alone. A business-wide cybersecurity plan needs to be in place as a first line of defense.'
It's Not Just About Backups, It's About Fast Recovery
Even if your backups survive an attack, speed of recovery matters. If restoring from backups takes days (or weeks), the damage may already be done.
Fred Lherault, Field CTO at Pure Storage, highlights how advanced solutions are tackling this challenge: 'Reliable backups are limited in their effectiveness if operations cannot be restored quickly. Some of the most advanced flash-based storage solutions dramatically increase recovery speeds, up to hundreds of terabytes per hour, enabling organizations to get up and running again in hours rather than weeks.'
When disaster strikes, slow recovery can force companies to make desperate decisions, like paying a ransom. Yihao Lim, Lead Threat Intelligence Advisor at Google Cloud Security, shares a real-world example: 'In 2018, a US hospital paid a four-bitcoin ransom due to lengthy restoration time from backups to their encrypted assets. The time needed for backups was not compatible with the hospital's almost real-time need to access health records, emails, or other internal applications.'
To avoid this, Lim advises organizations to simulate real-world attacks: 'Organizations should conduct simulated attack scenarios to test and measure the time taken to restore critical systems, ensuring they can resume operations quickly when disaster strikes.'
Why Testing and Layered Defense Matter
Backing up data isn't a one-time task, it's a continuous responsibility. Ziad Nasr, General Manager of Acronis Middle East, puts it bluntly: 'World Backup Day is an important reminder that protecting data is not a one-time task, it's a continuous responsibility. Regular and tested backups are essential to ensure your data is safe and recoverable.'
The reality is, even the best technology won't save you without proper processes in place. Ram Narayanan, Country Manager – Middle East at Check Point Software Technologies Ltd., advocates for a layered approach to protection: 'Ransomware has evolved, it's not just going after primary systems anymore; backups are firmly in the crosshairs. Businesses need to ensure their backups are frequent, immutable, and tested regularly. A layered approach that combines smart policies, strong cyber hygiene, and real-time threat prevention can make all the difference.'
Narayanan stresses that technical measures alone won't cut it, building employee awareness is just as critical.
Always Have a Plan B (and C)
Even with the best technology and processes, things can still go wrong. Rick Vanover, VP of Product Strategy at Veeam Software, offers this practical advice: 'Always have a plan A, plan B, and a plan C. We don't know what could go wrong, we can only plan ahead to prevent and be prepared. Whether it's a user deleting a file, a 'fire, flood, and blood' scenario, or a cyberattack, staying resilient is ALWAYS in style.'
Future-Proofing Your Backups
The old 'set it and forget it' mentality for backups no longer works. As Michael Cade says, World Backup Day itself needs to evolve:
'Like backups themselves, World Backup Day needs to level up and evolve. It sparks great conversation, but it needs to go beyond talking just backups in isolation and cover the full data resilience picture.'
In today's volatile digital landscape, businesses need to think beyond traditional backups. Checklists and automated reports are not enough. You need resilience, the ability to not only back up but to bounce back quickly.
Key Takeaways to Keep Your Backups from Failing
Test your backups regularly – Never assume a backup is safe until you've verified you can restore critical data. Adopt the 3-2-1 rule – Keep three copies of your data on two different media, with one copy offsite and ideally air-gapped. Embrace immutability – Ensure backups cannot be changed or deleted, no matter who gains access. Simulate real-world attacks – Regularly run disaster recovery drills to measure how fast you can restore operations. Secure your backup environment – Use multi-factor authentication, encrypt backups in transit and at rest, and restrict admin access.
As Rick Vanover says, resilience never goes out of style, and when it comes to backups, it's the only way to ensure your business survives the unexpected.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Tahawul Tech
3 days ago
- Tahawul Tech
Opinion: Veeam exec believes some organisations guilty of pulling the wool over their own eyes when it comes to data resilience
Tim Pfaelzer, Senior Vice President & General EMEA Manager at Veeam, has penned an op-ed, in which he states his belief that many organisations are guilting of fooling themselves when it comes to the strength of their own data resilience. For too long, business leaders have viewed their organization's data resilience from afar, relying on theoretical plans and a checklist mindset. This 2D perspective – where technical measures are simply ticked off a to-do list – fails to capture the full, real-world cross-organizational complexity of cyber threats. Ransomware, in particular, cannot be fully simulated on paper. This mentality has led to a dangerous false sense of security. Veeam research shows that more than 30% of organizations believe they are more resilient than they actually are. While they may have the right pieces in place, unless these elements work together in a rigorously tested, real-world incident response plan, they risk being exposed when a true crisis hits. With 69% of organizations having faced a ransomware threat in the past year, the time for blind confidence is over. Leaders must remove the wool from their eyes and take meaningful, proactive action. False Confidence, Real Consequences Data resilience can be deceptively complex, and gaps often remain hidden until it's too late. Many organizations fall into the trap of believing they are prepared, only to find out otherwise under attack. Of the organizations that fell victim to ransomware last year, 69% thought they were prepared beforehand. After experiencing an attack, confidence in their preparedness dropped by more than 20%. Although the majority of organizations had a ransomware playbook, less than half included essential technical components such as backup copies and containment or isolation plans. On the surface, everything may have appeared in order – but a closer inspection revealed significant vulnerabilities. The consequences of misplaced confidence are severe. Only 10.5% of organizations were able to successfully recover following a ransomware attack last year, leading to major business and operational impacts. The recent M&S ransomware incident is a high-profile example, causing not only service outages for customers but also an estimated £300 million hit to trading profits. The Evolving Threat Landscape Some organizations may have hoped that the disruption of major ransomware groups like BlackCat and LockBit by law enforcement would make the threat landscape easier to navigate. In reality, the threat has not diminished – it has evolved. Smaller groups and 'lone wolves' have quickly filled the gap, bringing new methods and tactics that further challenge organizational resilience. From 2D to 3D: The Path to True Resilience Regardless of how confident an organization may be in its data resilience, a deeper, more critical examination of its ransomware playbooks is essential. It is no longer safe to assume that what works on paper will hold up under real-life duress. Leaders must move from a flat, 2D perspective to a dynamic, 3D approach. Start with the big picture: Do you know what data you need to protect and where it resides? Are the key resilience measures, such as a predefined chain of command and regular backup verifications, in place? Drill down further: Are your security teams up to date on the latest attack trends? With 89% of organizations reporting their backup repositories targeted by threat actors, ensuring redundancy for your backups is now critical. Plugging the gaps is only the beginning. Organizations must stress-test their incident response plans with real-world simulations. It's not enough to rely on plan A – test plans B, C, D, and beyond, including scenarios where critical staff are unavailable or multiple crises occur simultaneously. This process often exposes blind spots that would go unnoticed in a theoretical plan. Turning Confidence Into Capability Leveraging frameworks like the Veeam Data Resilience Maturity Model (DRMM), developed in partnership with McKinsey, can help organizations move beyond blind confidence. Our findings show that organizations with a high degree of data maturity recover from ransomware incidents seven times faster than their less mature counterparts, and experience three times less downtime. By taking control of data resilience – grounded in rigorous testing, continuous improvement, and collective intelligence – organizations can replace blind confidence with real capability. In the current threat landscape, it's not a question of 'if' your organization will be attacked, but 'when'. The best time to prepare is now – because in data resilience, only true readiness will make the difference.
Channel Post MEA
3 days ago
- Channel Post MEA
Fortinet Introduces Quantum-Safe Security Features In FortiOS
Fortinet has announced expanded innovations within its unified operating system, FortiOS, that protect against quantum-computing threats to current encryption standards. The latest FortiOS capabilities help organizations with highly sensitive data deploy encryption algorithms and key distribution methods that can withstand quantum-powered attacks, stack algorithms for more robust protection, and easily transition to post-quantum security. 'At Fortinet, we're committed to arming customers with cutting-edge technology to protect against new and emerging threats. As quantum computing advances, organizations can trust Fortinet's technology innovation and leadership to safeguard their critical data and future-proof their infrastructures. Many enterprises are eager to take action to protect their networks from quantum-powered threats. That's why we've made cutting-edge, quantum-safe features available today for FortiGate NGFW and Fortinet Secure SD-WAN customers, so they can confidently transition to post-quantum security,' said Michael Xie, Founder, President, and Chief Technology Officer at Fortinet. Organizations Handling Sensitive Information Need Quantum-Safe Encryption Now Quantum computers can perform complex calculations at unprecedented speeds and can easily break current encryption standards. Cybercriminals are already storing encrypted traffic to decrypt in the future, with a particular focus on industries that handle highly sensitive data that remains relevant over long periods, such as telecommunications, financial services, government, and healthcare. FortiOS: ready for the post-quantum world With FortiOS 7.6, organizations, such as those using FortiGate next-generation firewall (NGFW) and Fortinet Secure SD-WAN, can now leverage built-in quantum-safe features designed to defend against emerging threats, including harvest-now, decrypt-later (HNDL) attacks. These capabilities help secure network traffic, simplify deployment, and support a smooth transition to post-quantum security. Customers have access to the following quantum-safe features at no additional cost: Post-quantum cryptography (PQC) methods, including National Institute of Standards and Technology (NIST)-approved algorithms like ML-KEM and emerging algorithms like BIKE, HQC, and Frodo. Quantum key distribution (QKD), leveraging quantum mechanics to enable the secure exchange of encryption keys, ensures that any eavesdropping attempts are detectable. Fortinet introduced support for QKD integrations starting with FortiOS 7.4, enabling interoperability with leading QKD vendors via standardized interfaces. This capability underscores Fortinet's proactive approach to quantum-resilient network security by integrating quantum-safe key exchange mechanisms into its NGFW architecture. Algorithm stacking, which combines multiple cryptographic algorithms to create a more resilient solution and enhance network infrastructure security. A hybrid mode for gradual transition to post-quantum security that enables seamless integration of traditional public-key cryptography and QKD. An enhanced user interface that simplifies the configuration and management of quantum-safe settings so that network administrators can implement quantum-safe security easily. Proven Innovation You Can Trust Fortinet was founded on the principle of converging networking and security through a single operating system. This unique approach enables Fortinet to deploy cutting-edge updates, such as quantum-safe innovations, across its unified operating system, helping customers future-proof their security postures.
TECHx
17-07-2025
- TECHx
Veeam Reveals 96% EMEA Financial Firms Struggle.
Home » Emerging technologies » Cyber Security » Veeam Reveals 96% EMEA Financial Firms Struggle Six months after the EU's Digital Operational Resilience Act (DORA) came into effect, Veeam® Software, the Data Resilience, announced findings from a Censuswide survey. The survey revealed that 96% of EMEA financial services organizations still feel their data resilience falls short. The study gathered insights from senior IT decision makers in the UK, France, Germany, and the Netherlands. It highlighted the challenges the sector faces in adapting to DORA, which was introduced in January 2025 to strengthen defenses against cyberthreats and ICT disruptions. 'It's promising to see that most organizations have embraced and feel confident about meeting DORA's requirements,' said Edwin Weijdema, Field CTO EMEA at Veeam. 'Achieving compliance is an important first step in ensuring your organization is resilient but given today's complex threat landscape there's more to do. New Veeam research shows that many financial institutions still see a gap in their overall resilience and face challenges in securing the necessary budget, even as DORA grows in strategic importance. The journey to operational resilience is ongoing, and it's clear that prioritizing data resilience remains critical for organizations' long-term success.' While 94% of organizations reported that DORA is now a higher priority than before the deadline, 40% called it their top digital resilience focus. Half said DORA requirements are part of their wider resilience programs. However, many continue to face obstacles: 41% reported increased stress on IT and security teams. 37% dealt with higher ICT vendor costs. 22% saw digital regulations as barriers to innovation. Despite the focus on compliance, many firms have yet to complete key requirements such as recovery testing, incident reporting, and third-party risk oversight, which 34% cited as the hardest to implement. Andre Troskie, Field CISO EMEA at Veeam said, 'It's interesting to see that third-party oversight has emerged as a particular pain point for organizations. Over a third named it the most challenging to implement, and many called for additional guidance on establishing it in the first place. An often-overlooked facet of data resilience, it's promising to see that organizations are interrogating their defences to this degree which is exactly what it was designed to do. Of course, meeting the requirements is key, but DORA was also about getting organizations to assess their resilience holistically and in that aspect, it seems to be succeeding.' Veeam's experts stressed that while compliance is crucial, true operational resilience requires ongoing effort and holistic data resilience strategies. The company also highlighted its Data Resilience Maturity Model (DRMM), developed with McKinsey, which helps firms assess and improve their resilience against evolving risks. This research emphasizes the growing importance of digital operational resilience for financial institutions across EMEA as they navigate the new regulatory landscape.
