security strategy

August 14 2023

Cybersecurity and the Metaverse: Risks, Threats, Challenges, and Opportunities

Raphael Iloh Artificial Intelligence, Business Continuity, Business Strategy, Cyber Security, Cybersecurity Governance, Infosec, Leadership, Metaverse, Risk Assessment, Risk Management, Security Architecture, Security Risks, Security Strategy artificial intelligence, business agility, business continuity, Business Strategy, Competitive Advantage, compliance, Cyber Security, cybersecurity, data protection, governance, infosecurity, innovation, leadership, Metaverse, privacy, risk management, Security Risks, security strategy, third party risk management

The metaverse, a boundless realm where the lines between the real and the virtual blur into a kaleidoscope of possibilities. The metaverse is a term that describes a 3D virtual world that integrates physical and digital realities as well as enables immersive and interactive experiences for users. Imagine being able to visit any place, meet any person, or do any activity in a realistic and engaging way, without leaving your home.

In this digital utopia, businesses and organizations across various sectors (including retail, finance, education, healthcare, and defence) are embarking on an extraordinary journey. That is the vision of the metaverse, which is expected to experience exponential growth following the ongoing huge improvements and strides in Generative Artificial Intelligence (AI). According to the Wall Street Journal (WSJ), metaverse spending is projected to reach US$5 trillion by 2030 i.e., within the next 7 years.

However, as we delve deeper into the wonders of the metaverse, we must tread with caution and embrace cybersecurity to safeguard this new frontier. In a couple of previous posts, we discussed Artificial Intelligence (AI) in healthcare services. In this article, we’ll discuss some of the main cybersecurity challenges and risks that the metaverse poses to organizations and how they can be effectively addressed. We’ll also discuss some of the opportunities that the metaverse offers to organizations and how they can leverage them to gain a competitive edge.

Understanding the Metaverse: Unravelling the Infinite

The metaverse, a concept once confined to science fiction, is now a reality, rapidly evolving through the convergence of virtual reality, augmented reality, blockchain, the Internet of Things (IoT), and the power of Generative AI. These technologies enable the creation of realistic and dynamic virtual environments that can be accessed by millions of users simultaneously.

This immersive domain transcends the limits of screens and keyboards, presenting an entirely new interface between humans and information. In the retail sector, fashion retailers allow customers to try on virtual outfits, providing a personalized shopping experience like never before. Financial institutions are exploring virtual banks, offering seamless transactions through virtual reality interfaces. Even healthcare is leveraging the metaverse to simulate complex surgeries and explore innovative medical treatments.

However, as with any new technology, the metaverse also brings new challenges, risks, and threats that need to be addressed by cybersecurity professionals and business leaders. The metaverse is a complex environment that’s highly interconnected, which creates new kinds of cybercrime and attack surfaces. Cybersecurity in the metaverse involves the security of the hosting platform, the property, and the users of the property.

Cybersecurity Challenges and Risks in the Metaverse

The metaverse is not immune to cyberattacks. In fact, it may be more vulnerable than the traditional web due to its novelty, complexity, and diversity. Some of the cybersecurity challenges and risks that organizations may face in the metaverse include:

Lack of regulations: The metaverse is still an emerging phenomenon that has not been fully regulated by governments or industry standards. This creates uncertainty and ambiguity for both platform owners and property owners regarding their rights and responsibilities. For example, who owns the data generated by users in the metaverse? Who is liable for any damages caused by cyberattacks or malicious actors? How can intellectual property rights be enforced in the metaverse? What are the obligatory AI ethics for the metaverse? These are some of the questions that need to be clarified and addressed by legal frameworks and policies.
Identity theft: The metaverse allows users to create and customize their respective avatars and personas that represent them in the virtual world. However, this also creates opportunities for identity theft and impersonation by cybercriminals who can use AI-generated deepfakes to create realistic and convincing fake images or videos of individuals or organizations. Deepfakes can be used for various malicious purposes, such as fraud, extortion, blackmail, defamation, or propaganda.
Data breaches: The metaverse generates massive amounts of data from user interactions, transactions, preferences, behaviours, emotions, biometrics, and more. This data is valuable for both legitimate and illegitimate purposes. For example, data can be used to improve user experience, personalize content, offer recommendations, or provide insights. However, data can also be used to target users with phishing attacks, spam messages, malware infections, or ransomware demands. Data breaches can expose sensitive information that can compromise user privacy or security.
The recent compromise of the MOVEit Transfer file management software; a computer program used by over 600 organizations worldwide including UK Ofcom, US Department of Energy, Deutsche Bank, PwC, and EY; is reported to have affected nearly 40 million people. The hydra-headed data breach incident of such magnitude perhaps underscores the possible damages that could be caused if something similar were to happen in the metaverse.
Malware infections: The metaverse relies on various devices and platforms to deliver its services and experiences. These devices and platforms may have vulnerabilities that can be exploited by hackers to inject malware into the system. Malware infections can disrupt or damage the functionality or performance of the devices or platforms or steal or encrypt data from them. Malware infections can also spread from one device or platform to another through network connections or user interactions.
Cyberattacks on critical infrastructure: The metaverse depends on critical infrastructure such as power grids, telecommunications networks, cloud servers, or IoT devices to operate smoothly and reliably. However, these infrastructure components may also be targeted by cyberattacks that aim to cause physical or digital harm or disruption.
For example, cyberattacks on power grids could cause blackouts or brownouts that affect millions of users in the metaverse. Cyberattacks on telecommunications networks could cause latency or connectivity issues that degrade user experience or prevent access to the metaverse. Cyberattacks on cloud servers could compromise data integrity or availability or cause service outages. Cyberattacks on IoT devices could hijack or manipulate their functions or data.

Cybersecurity Solutions for the Metaverse: Thriving amidst Adversity

The metaverse poses significant cybersecurity challenges and risks that require proactive and comprehensive solutions from organizations. Some of the cybersecurity solutions that organizations can implement to protect themselves and their users in the metaverse include:

Establishing cybersecurity governance: Your organization should develop and enforce a proactive cybersecurity governance model that includes clear and consistent policies and standards. These policies and standards should cover aspects such as privacy-by-design principles, privacy-by-default tenets, data ownership, data protection, data sharing, user consent, user verification, user behaviour, user feedback, user rights, user responsibilities, system status, dispute resolution, incident response, and compliance.
Ensuring regulatory compliance: To ensure and promote a more compliant predisposition amidst a shifting metaverse landscape and ever-changing regulations, your organization should adopt a proactive approach involving regular audits and swift adaptation.
Educating and empowering users: Your organization should educate and empower its users in the metaverse. You should inform users about the potential cybersecurity risks and threats that they may encounter in the metaverse and how to avoid or mitigate them. You should also provide users with the necessary tools and resources to protect themselves and their data in the metaverse, including privacy settings, security settings, reporting mechanisms, feedback mechanisms, or security awareness training.

Cybersecurity Opportunities in the Metaverse

The metaverse is not only a source of cybersecurity challenges and risks but also a source of cybersecurity opportunities for organizations. Some of the cybersecurity opportunities that organizations can leverage in the metaverse include:

Enhancing user experience: Organizations can use cybersecurity as a competitive advantage to enhance user experience in the metaverse. They can offer their users a secure, reliable, and trustworthy environment that fosters confidence, loyalty, satisfaction, and engagement. They can also use cybersecurity as a differentiator to attract new users or retain existing users who value security as a key factor in their decision-making.
Expanding business opportunities: Organizations can use cybersecurity as a catalyst to expand their business opportunities in the metaverse. They can explore new markets or segments that are emerging or growing in the metaverse. They can also create new products or services that address the specific needs or demands of users in the metaverse.
Innovating business models: Organizations can use cybersecurity as an enabler to innovate their business models in the metaverse. They can adopt new ways of delivering value to their customers or stakeholders in the metaverse. They can also leverage new sources of revenue or cost savings that are enabled by cybersecurity technologies or practices in the metaverse.

What isn’t hard to imagine for us in cybersecurity is that the metaverse is going to greatly expand the threat landscape. So, the metaverse is more than an imaginative exercise for us; it’s the future – a future we should ideally start planning for now.
— Jonathan Singer, Senior Product Marketing Manager, Checkmarx

Final thoughts

The metaverse is a promising phenomenon that offers unprecedented opportunities for organizations to create immersive and engaging experiences for their users.

However, the metaverse and Generative AI will become more pervasive, diverse, and complex, requiring more advanced and adaptive cybersecurity solutions, posing significant challenges and risks for organizations to secure their platforms, properties, and users from cyberattacks or malicious actors.

Therefore, businesses and organizations need to adopt proactive and comprehensive cybersecurity solutions that can protect themselves and their users in the metaverse while leveraging its potential benefits. They should adopt best practices and recommendations to enhance their cybersecurity posture and resilience in the metaverse, such as adopting a cyber resilience strategy, implementing a zero-trust model, using blockchain technology, leveraging artificial intelligence tools, establishing clear policies, standards, guidelines, roles, responsibilities for cybersecurity management, and collaborating with other stakeholders in the metaverse ecosystem.

If you need help developing and implementing effective cyber resilience strategies within your organization, or you’re simply interested in learning more about effective cybersecurity and risk management best practices, then please feel free to contact me today.

また会うまで – take care, until we meet again.

top cybersecurity risks trends and predictions for 2023

December 31 2022

Top Cybersecurity Trends and Predictions for 2023

Raphael Iloh Cyber Security, Risk Assessment, Risk Management, Security Risks, Security Strategy, Third-Party Risk Management compliance, cybersecurity, data breach, infosecurity, predictions, resilience, riskmanagement, risks, security, security strategy

Without a doubt, 2022 has been such an eventful year in the world of cybersecurity. There were over 2.8 billion reported cases of malware attacks worldwide and over 236 million reported cases of ransomware attacks just in the first half of the year.

In 2022, the government of Costa Rica declared a state of emergency and Toyota was forced to shut its 14 factories in Japan, following different and several cyberattacks.

As we enter the last few hours of 2022 and look forward to 2023, cybersecurity remains top of the agenda for the leaders of several businesses and organizations worldwide.

It is, therefore, natural to start thinking about what the next year might bring in terms of cybersecurity trends and predictions, and help inform decisions on information security strategies and budgets.

Here are my top 10 cybersecurity trends and predictions for 2023:

Ransomware Attacks

Ransomware attacks, in which hackers encrypt a victim’s data and demand payment to decrypt it, have been a major problem in recent years. These attacks are likely to continue in 2023, as hackers find new ways to target businesses, organizations and individuals across different spectrums in different societies and cultures.

Remote Work Security

The shift towards remote work, accelerated by the COVID-19 pandemic, has created an increased need for secure remote access solutions. The nature of remote work is changing and more organizations are adopting policies and environments that allow their employees to carry out their respective tasks remotely more effectively.

In 2023, we can expect to see a continued focus on this area, as organizations look for ways to protect their networks and data while employees are working remotely.

Further developments in this area include the adoption of virtual private networks (VPNs) and other secure remote access technologies, as well as the implementation of strong authentication protocols and the use of multi-factor authentication.

Another major trend in this space is something known as Decentralized Security; a comprehensive network of proactive and reactive defenses with built-in machine learning features that monitor endpoints, identities, and access regardless of who the users are, what they do, or wherever they may be connected from.

Supply Chain Attacks

Supply chain attacks involve compromising the security of a third-party vendor or supplier to gain access to an organization’s systems or data. These attacks can be difficult to detect and prevent because they usually do not involve any direct interaction with the target organization.

Organizations can establish steps to mitigate against such attacks including implementing secure supply chain practices, conducting thorough random checks on their suppliers, and implementing incident response plans.

A recent policy statement published by the Bank of England outlines regulations that affect financial institutions regarding outsourcing and third-party risk management.

New Technologies & More Attack Vectors

As new technologies emerge, they will also bring new attack vectors for hackers to exploit. In 2023, we may see an increase in attacks targeting the internet of things (IoT), as well as attacks targeting emerging technologies such as 5G networks and quantum computers.

Artificial Intelligence and Machine Learning

Artificial intelligence (AI) and Machine Learning (ML) have already started to play a significant role in cybersecurity, and this is likely to continue in 2023. These technologies can be used to analyze large amounts of data and identify patterns and anomalies that might indicate a security threat.

One example of this is the use of AI and machine learning to analyze log data and identify unusual activity that might indicate a cyberattack. This can help organizations respond more quickly to threats and minimize the damage caused by an attack.

Regulation and Compliance Requirements

As cybersecurity threats continue to evolve and become more sophisticated, we are likely to see increased regulation and compliance requirements in the coming year. This may include new laws and regulations that require organizations to implement certain security measures, as well as increased penalties for organizations that fail to meet these requirements.

Last year, I wrote an article about the Digital Operational Resilience Act (DORA) regulation proposed by
the European Union (EU).

With DORA, the EU aims to harmonize and improve risk management and operational resilience within the financial sector across the region by addressing many of the issues that concern leadership, governance, and continued operations through a severe operations disruption as well as establishing an oversight framework for managing ICT critical third-party providers (CTPPs).

The Council of the European Union (i.e., EU Council) recently adopted DORA as policy across the region.

Evolution of Cyber Threats

Cyber threats are constantly evolving, and we can expect to see new types of attacks and tactics in 2023. As hackers become more sophisticated, they will continue to find new ways to target organizations and individuals.

To protect against these evolving threats, it will be important for organizations to stay informed about the latest developments in cybersecurity and to implement effective security measures. This may involve investing in new technologies and training employees to recognize and respond to potential threats.

Cloud Security Solutions

The use of cloud-based security solutions is likely to increase in 2023, as organizations look for ways to protect their data and systems in the cloud. This may include the use of Cloud Access Security Broker (CASB) services and other cloud security technologies.

Zero-Trust Security Models

Zero-trust security models, which assume that all users and devices are untrusted until proven otherwise, are likely to become more popular in 2023. These models can help organizations protect against insider threats and ensure that their networks and systems are secure.

We can expect more security products and services to be compliant with zero-trust models, satisfying all seven tents of the NIST 800-207 model on zero-trust, as an example.

Data Privacy and Protection

As more data is collected and stored online, the protection of personal and sensitive information will continue to be a major concern in 2023. Organizations will need to implement strong data privacy measures to ensure that they comply with applicable laws and regulations as well as protect against data breaches.

“How do we effectively protect our consumers’ information from unauthorized access, use, and abuse?” This is just one of many pertinent questions that information security and risk leaders must anticipate for the future and plan accordingly.

Cybersecurity Insurance

According to a recent report, the global cybersecurity insurance market size is expected to reach US$32.6 billion by 2028.

As the risks of cyberattacks continue to grow, we can expect to see an increase in the use of cybersecurity insurance in 2023. This type of insurance can helps organizations protect against the financial impacts of a cyberattack and ensure that they have the resources to recover from an incident.

We’re falling into this old habit of trying to treat everything the same as we did in the past… This simply cannot continue. We need to make sure that we are evolving our thinking, our philosophy, our program, and our architecture.
— Sam Olyaei, Gartner Analyst

In conclusion, 2023 is likely to see an increase in supply chain attacks, state-sponsored cyberattacks, a continued focus on the security of remote work, the emergence of new technologies and attack vectors, and the growth of ransomware attacks. However, it will also be a year for some organizations to derive benefits from their investments, preparedness, and innovations in information security and regulatory compliance best practices.

gdpr data regulations in the uk post brexit

January 14 2020

GDPR Post-Brexit – The Data Regulation Frontier in the United Kingdom After Brexit

Raphael Iloh Cyber Security, Infosec, Risk Management, Security Risks brexit, business agility, business continuity, cyberattacks, cybersecurity, cyberthreats, data breach, data privacy, data protection, data protection act 2018, data protection officer, data security, dpa 2018, dpo, edpb, enterprise, eu, european data protection board, european union, gdpr, governance, ico, information commissioners office, infosec, post-brexit, regulations, regulatory compliance, risk assurance, risk management, risk mitigation, risks, security, security strategy, siem, strategy, threats, uk, united kingdom, watchdog

Yes, Brexit is happening! The United Kingdom is scheduled to exit the European Union by the end of this month i.e. on 31 January 2020. And there are already loud callouts on social media for hundreds of thousands of people to gather in Westminster at 23:00 on 31/Jan/2020 to celebrate Brexit and usher in perhaps what you could call the “new and rediscovered” United Kingdom.

The General Data Protection Regulation (GDPR) came into force in May 2018 across all the European Union (EU) member states and the European Economic Area (EEA). The regulation requires businesses and organisations to protect the personal data and privacy of EU citizens. The regulation aims to give individuals greater control over their privacy, how their personal data is collected, stored, shared, and generally used.

Whenever there are data breaches or information breaches, the regulation requires that “culprit” businesses and organisations must report the events to authorities and inform individuals affected or impacted by such breaches, all within the stipulated time frame; usually within 72 hours of them finding out about the breach. The regulation imposes hefty penalties on non-compliance.

Perhaps it’s fitting to emphasise that the word “organisations” is used here loosely to include for-profit organisations, not-for-profit organisations, and government institutions and offices. Literally speaking, every type of organisation that handles or comes into contact with personal information of people in the EU is factored into the word.

GDPR Basics: Make sure you know what information you hold, where you hold it, why you hold it, and how people consented to give it to you.
— Zoë Findon

The Information Commissioner’s Office (ICO) is the independent data protection and information rights watchdog in the UK. The GDPR regulation was adopted into UK law through the Data Protection Act 2018 (DPA 2018).

According to stats and reports published by the European Commission on the occasion of the first-year anniversary of the GDPR regulation, over two-thirds (67%) of Europeans have heard about GDPR and nearly 90,000 Personal Data Breach (PDB) reports were received across Europe within the first year of GDPR.

In October 2019, Österreichische Post AG (ÖPAG); the national postal service providers in Austria; was fined €18 million (approximately US$20 million) for illegally selling personal data of approximately 3 million Austrians to various third parties.

In January 2019, Google was fined €50 million (approximately US$56 million) by CNIL; the data protection and information rights watchdog in France; for breaching GDPR requirements for transparency and specific, unambiguous consent.

The online advertising industry is behind comprehensive illegal collection and indiscriminate use of personal data
— The Norwegian Consumer Council

In the UK, more specifically, similar stats and reports from the ICO show that PDB reports went up by over 324% to 14,000 by May 2019 from the previous reporting year when the reports were put together under the previous DPA 1998 legislation.

Some high-profile data breach and non-compliance cases reported in the UK include the maximum fine of £500,000 (approximately US$660,000) issued to Facebook for data breaches that allegedly occurred in 2017. The ICO later admitted that the fine could have been a lot higher under the GDPR legislation.

Under the GDPR regulation, a business or organisation that is found to have infringed on the provisions of the GDPR regulation, could be fined up €20 million (approximately US$22 million), or in some situations, up to 4% of its total worldwide annual turnover in the preceding financial year, whichever is higher.

Just thinking of the huge figure, you can understand the thoughts of the ICO re Facebook, and you might just say that Facebook was lucky, eh?

In July 2019, the ICO issued a notice of its intention to fine Marriott International £99 million (approximately US$131 million) for GDPR breaches relating cyber incidents suffered by the hoteliers which compromised the personal data of approximately 339 million guests globally.

In April 2019, a local government council in the Greater London area was fined £145,000 (approximately US$191,400) for unlawfully disclosing the personal information of more than 200 people.

In November 2018, Uber was fined £385,000 (approximately US$508,200) because the company failed to protect customers’ personal data during a cyberattack.

In May 2018, the UK Crown Prosecution Service (CPS); i.e. the UK equivalent to the U.S. Attorney’s Office (USAO); was fined £325,000 (approximately US$429,000) for the loss of several encrypted DVD discs containing records of police interviews.

A recent information breach (and a major security concern) occurred in the UK when the UK government inadvertently publicly published the full home and work addresses of over 1,000 New Year (2020) Honour recipients on the internet. As we understand it, the ICO is yet to rule on this matter or yet to publicly announced its ruling.

But, perhaps the biggest GDPR fine in the UK so far; in July 2019, the ICO issued a notice of its intention to fine the British Airways £183.39 million (approximately US$242 million) for GDPR breaches relating to cyberattacks suffered by the airline which compromised the personal data of approximately 500,000 customers.

general data protection regulation gdpr

You’d recall that in my article at the start of the year, I reviewed some major breaches that were reported in 2019

I’ve always posited that cybersecurity risks, threats, and attacks pose a significantly high risk to businesses and organisations. This is simply because breaches of information or data could potentially result in financial damages, operational damages, reputational damages, diminished investors’ confidence and exposure to potential regulatory, statutory, and other compliance issues, plus penalties.

The GDPR regulation permits free data flow between EU member states and EEA. But it places stringent rules, safeguards, and controls on the transfer of data from the EU to recipients in a third country, a territory, or an international organisation.

Implicitly, therefore, after 31/Jan/2020, the UK will be considered a “third country” by the EU, and all relevant rules applicable to third countries and international organisations under the GDPR will become applicable to the UK. Conversely of course, after the Brexit date, the EU GDPR will no longer apply to the UK.

So, it’s quite understandable that one of many questions which has repeatedly popped up in conversations with businesses and organisations up and down the country is; what does a post-Brexit UK mean to businesses and organisations in terms of GDPR requirements?

My reassuring response is always; there is no immediate or critical need to fret or be excessively be worried.

According to the ICO, “the UK government intends to write the GDPR into UK law, with the necessary changes to tailor its provisions for the UK (the ‘UK GDPR’).”

This implies that the UK government will immediately incorporate the EU GDPR into UK law with only necessary UK-specific changes to bring about the UK GDPR.

If you are a UK business or organisation that receives personal data from contacts in the EEA, you need to take extra steps to ensure that the data can continue to flow after Brexit.
If you are a UK business or organisation with an office, branch or other established presence in the EEA, or if you have customers in the EEA, you will need to comply with both UK and EU data protection regulations after Brexit. You may need to designate a representative in the EEA.
— Information Commissioner’s Office

Yes, there would be some changes but these would be absolutely necessary changes, and both sets of regulations are expected to be substantially very similar.

My understanding, therefore, is that any immediate changes that’s required to be made to the UK GDPR will not require complete rework of your existing internal controls, processes, frameworks, policies, procedures, and reporting in your management information systems.

For UK-based SME businesses and organisations that want to keep data flowing between the UK and the EU, the ICO has released an interactive tool that could help you determine whether Standard Contractual Clauses (SCCs) could help you maintain the flow of data, in the event of a no-deal Brexit.

Remember, whatever effective controls and processes you currently have in place to address the EU GDPR regulation, these may require a few changes to ensure they remain relevant to the UK GDPR. But, rest assured, they would still be reasonably effective and applicable post-Brexit. And I expect the ICO would give businesses and organisations some reasonable time to implement whatever necessary changes emerge.

I envisage that the probabilities of cybersecurity risks, threats, and attacks will probably most likely increase/heighten in the few weeks, months, and possibly couple of years right after Brexit. My informed understanding, however, is that whatever effective controls, monitoring, and response strategies & policies you already have in place would suffice, for now. Of course, the key operative word here is “effective“!

January 7 2020

The 3-2-1 Backup Rule and Effective Cybersecurity Strategy

Raphael Iloh Backup Strategy, Cyber Security, Security Risks, Security Strategy attacks, backup, bau, business continuity, cyber threats, cybersecurity, cyberthreats, cyberwar, cyberwarfare, data backup, disaster recovery, high availability, mttr, networksecurity, risks, security strategy, securitybydesign, siem, strategy, threats, zerotrust, zerotrustmodel

Last week, I wrote an article on top cyber security risk trends and predictions for 2020.

In the article, I reviewed some very significant breaches and attacks that occurred in 2019, touched on common cyber risks, threats, and attacks, and made predictions on what we should expect for 2020.

An interesting conversation kicked off amongst some security professionals on an online professional networking platform a few days. The conversation centred on the 3-2-1 backup rule, and how strategy measures or compares to assessing and preparing for cybersecurity threats & attacks for 2020.

The one question that seemed to pop-out of the conversation is this: Is the 3-2-1 backup rule sufficient enough to constitute or be considered as an effective cybersecurity strategy?

I’ll give my response to this question in the course of this article. But for now, let’s have a bit more contexts, definitions, and discussions on several bits of the subject, shall we?

What’s the 3-2-1 Backup Rule?

The 3-2-1 backup rule is a best practice data backup strategy that aims to ensure that data is adequately protected and resilient to potential damage and corruption.

The rule states that there should be at least three (3) copies of the data, store two (2) copies on different storage media, and keep one (1) of these copies in an offsite/remote location.

You’d notice, from the image above, that the title on the image states the 3-2-1 Backup Rule but the image appears to suggest that the rule should be called the 3-2-1-0 Backup Rule instead.

A few alternative postulations in the community state that the proper and correct best backup practice strategy should include a step that covers valid and verified data recoverability.

I do agree with the views I’d just cited above, and, thus, I felt the need to capture the 3-2-1-0 steps as also representing the 3-2-1 backup rule.

Anyway, moving on…

Yes of course! Data backup and restore are essential elements of any security strategy that’s worth its weight in salt. Absolutely. Without any doubt.

Every effective Business Continuity and Disaster Recovery (BC/DR) plan needs a very good backup strategy to be successful. The 3-2-1 backup rule is effectively all about redundancy, ensuring data resilience and availability.

As stated by Alex Mayer, “the 3-2-1 backup rule is a good recommended start in building any data protection system – a way to protect your data from loss/corruption…”

Consequently, I think we should be very clear about one thing: the 3-2-1 data backup rule is not a panacea for cyber security risks, threats, and attacks.

If your organisation (or one of your clients) had experienced any previous yet successful security attacks, you would learn that data backup is indeed a vital risk mitigating action but:

It does not address or mitigate against potential severe interruptions to business operations (i.e. BC/DR, BAU, MTTR, etc.)
It does not address or mitigate against attacks that target networks and infrastructure
It does not address or mitigate against attacks that make illegal and unauthorised copies of data
It does not address confidentiality or integrity of data nor information; 2 of 3 principles of the cybersecurity triad
It does not address, resolve, or eliminate actors of the attack (both internal & external), and invariably,
It does not eliminate, thwart, or deter/discourage the repeat of the (previously successful) attack or similar attacks.

I can affirm that combating and winning any cyberwarfare against cybersecurity risks, threats, & attacks requires more than implementing the 3-2-1 backup rule.

So, here’s my response to the question raised earlier on: the 3-2-1 backup rule should form a vital part of any good Security Incident and Event Management (SIEM) plan. But it is probably most certainly not a replacement or a substitute for an effective cybersecurity strategy.