{"id":2935,"date":"2024-08-14T16:04:47","date_gmt":"2024-08-14T16:04:47","guid":{"rendered":"https:\/\/softwaredefinedautomation.io\/?p=2935"},"modified":"2024-08-14T16:04:47","modified_gmt":"2024-08-14T16:04:47","slug":"manufacturing-has-a-backup-problem","status":"publish","type":"post","link":"https:\/\/www.softwaredefinedautomation.io\/sda-old\/resources\/blog\/2024\/08\/14\/manufacturing-has-a-backup-problem\/","title":{"rendered":"Manufacturing Has a Backup Problem\u2014but It Is Solvable"},"content":{"rendered":"

We all know why backups are important: If you have physical site damage, for example, backups are what enable you to restore your environment. While there are many different types of disasters you need to plan for, one of the fastest growing threats is ransomware.<\/p>\n

The ransomware trends in manufacturing are troubling<\/h3>\n

Sophos, a cybersecurity and threat intelligence company, recently released the <\/span>2024 results of its annual study<\/span><\/a> of the real-world ransomware experiences of manufacturing and production organizations, and the statistics are dire. According to their findings, ransomware attacks in manufacturing have increased 41% since 2020, and two-thirds of respondents (65%) have experienced some form of an attack. <\/span><\/p>\n

Often what happens during a ransomware attack is that perpetrators exploit a vulnerability somewhere in the environment to gain access and encrypt systems, preventing you from accessing them. They then demand a ransom in exchange for releasing those systems back to you. What\u2019s vulnerable in a manufacturing environment? Of course, the programmable logic controllers (PLCs) themselves are a target, but so is all the data\u2014including a backup\u2014software, applications, servers, and even the OS. In short, anything that\u2019s running anywhere in your operational technology (OT) network is vulnerable. So, you need to be able to move that entire backup footprint (data, software, licensing, servers, etc.) off-premises to be able to quickly recover during and after an attack or other incident.\u00a0<\/span><\/p>\n

But moving it all off site is just one piece of an effective disaster recovery strategy\u2014because just having the backup doesn\u2019t do you much good if you can\u2019t easily and quickly reinstall it all. You also need to minimize your mean time to recovery (MTTR). According to the Sophos report, the number of ransomware victims in manufacturing able to fully recover in a week or less is trending in the wrong direction, from 67% in 2022 to 55% in 2023 and only 44% in 2024. Similarly, the number needing more than a month to recover is shooting up from 10% in 2022 to 18% in 2023 and 22% in 2024. Given the staggering losses these prolonged shutdowns create, this trend is highly concerning.<\/span><\/p>\n

\"\"<\/p>\n

 <\/p>\n

And when it comes to ransomware, there\u2019s an added risk in the backup and recovery picture that many manufacturers may not be considering.<\/span><\/p>\n

Your backups aren\u2019t as safe as you think<\/h3>\n

The Sophos report also found that in 93% of the manufacturing organizations hit by attackers in the last year, it was the backups that were the target. I want to pause on that number, because 93% may as well be 100% for all practical purposes.<\/p>\n

Unfortunately, there\u2019s still more bad news: In more than half of the ransomware incidents (53%), the attackers were able to successfully compromise the backups. And when that happens, the outcomes are significantly worse:<\/p>\n