Summary of on-demand webinar:

Introduction

Welcome to this joint webinar by Dell and Continuity Software. Today, we’ll shed light on an often-overlooked area of cybersecurity: storage and backup configuration. We’ll explore real-world cyber incidents, attack anatomy, and offer practical recommendations for securing these critical systems.

Why This Topic Matters

Cyber attackers are evolving—and they’re now targeting storage and backup systems directly. These platforms, once considered back-office infrastructure, are now strategic assets and prime targets in sophisticated attacks.

Real-World Examples of Attacks

• Ukraine Mobile Provider: During the Russia-Ukraine conflict, a cyberattack destroyed servers, storage, and backups, disrupting the country’s largest mobile operator.

• United Health: Backup systems were breached, delaying recovery and magnifying operational impact.

Key takeaway: Weak configurations in storage and data protection systems can make or break recovery success.

Anatomy of a Modern Cyber Attack

1. Initial Access: Attackers exploit compromised credentials, phishing, vulnerabilities, or social engineering to infiltrate.

2. Privilege Escalation & Reconnaissance: They identify high-value assets using techniques like AD enumeration, network discovery, and credential harvesting.

3. Targeting Storage & Backup Systems: Once attackers gain control, they can:

   • Corrupt or delete backups

   • Disable immutability

   • Exfiltrate sensitive data

Organizations must assume breach and prepare defenses accordingly.

Who Owns Storage and Backup Security?

A live poll revealed:

• 76%: Shared responsibility between IT & InfoSec

• 24%: IT Infrastructure

• 0%: Information Security only

Conclusion: It’s a collaborative effort.

• InfoSec sets policies, standards, and compliance frameworks.

• IT implements and enforces those controls within backup and storage environments.

Auditing often spans multiple groups (e.g., GRC, internal audit, external auditors), underscoring the need for coordination.

Key Recommendations

1. Establish a Secure Configuration Baseline

• Define and maintain hardening baselines per platform.

• Cover key areas: authentication, encryption, RBAC, logging, remote access, etc.

• Continuously validate baseline adherence to prevent drift.

• Use tools like StorageGuard to automate scans and generate reports.

2. Implement Dual Authorization

Also known as:

• Four-Eyes Principle

• Two-Man Rule

• Dual Control

This requires two users to authorize critical changes. It’s not a substitute for MFA, but an additional layer of protection against malicious insiders and compromised accounts.

3. Isolate Your Backup Environment

• Avoid shared services with production (e.g., Active Directory).

• Use dedicated credentials and networks.

• Disable unnecessary protocols and services.

• Enforce least privilege access.

• Maintain air-gapped or offline backups.

StorageGuard helps validate isolation and configuration status across environments.

4. Stay on Top of Vendor Advisories

• Track firmware, OS, CLI software, plugins, etc.

• Create and maintain an inventory of versions and patches.

• Use automation to match advisories with your installed base.

• StorageGuard includes a continually updated advisory knowledge base and alerts you to exposures.

5. Adopt Best Practice Security Measures

• Forward logs to SIEM (Splunk, QRadar, etc.)

• Replace insecure protocols (HTTP, SNMP, LDAP) with secure versions.

• Use both retention-locked snapshots and backups.

• Harden NTP configurations to prevent time-based immutability bypass.

• Enforce ACLs and zero-trust communication principles.

• Avoid storing all backups on a single platform.

About StorageGuard

StorageGuard, part of the Dell ETC program, offers:

• Agentless, read-only scanning

• Customizable security baselines

• Drift detection & remediation workflows

• Vendor advisory correlation

• Audit-friendly compliance reports

It’s built to simplify enterprise-scale storage and backup hardening, regardless of vendor or environment.

Final Thoughts & Next Steps

Action Items:

• Define your configuration baselines

• Enforce dual authorization

• Isolate your backup infrastructure

• Monitor vendor advisories

• Regularly validate and improve your posture

Explore more resources at:

• continuitysoftware.com

• Dell Technologies’ Data Protection Portfolio