By Dmitry Dontov, CEO and Chief Architect of Spin Technology
In the wake of the global pandemic, organizations of all types and sizes have pivoted to cloud resources to accommodate the rise of distributed, remote work. Businesses have never been more reliant on the cloud than they are today. The proof is in the remarkable growth we’re seeing in cloud spending and cloud software-as-a-service (SaaS) subscriptions. Gartner forecasts public cloud services spending to grow 18.4% in 2021 to a total of $304.9 (up from $257.5 billion just last year). And despite the drop in overall IT spending in 2020, SaaS remained the largest cloud market segment. Regardless of how this health crisis plays out, we’re in the midst of the remote work age and there’s no reason to think the accompanying reliance on cloud services will fade any time soon.
As organizations adopt these services at historic rates, the volume of business-critical data organizations house in cloud environments is reaching a fever pitch. This raises some grave concerns when it comes to security, recovery and overall business operations. Is your data protected by default? How critical are backups of your cloud-based services and data? What options do you have to increase protection for that data? The list goes on. Let’s dive into several concerns around today’s cloud environments and three key considerations for SaaS data backup that can improve security and resilience.
Where Does the Cloud Security Buck Stop?
One popular cloud SaaS environment seeing tremendous growth is Microsoft Office 365. Businesses have been looking for any and every way to empower remote workers to better communicate, collaborate and operate regardless of location. As a result, Microsoft Teams subscriptions swelled significantly from 44 million active users in March 2020 to 75 million by April 2020. In general, Microsoft Office 365 has over 250 million individuals already using the platform monthly, with 20% growth annually. But as the world becomes increasingly cloud-reliant, organizations must come to grips with their responsibility for data protection and backup – especially when that data resides within Microsoft Office 365 and other cloud environments like it.
Some believe these types of hyperscale environments are so resilient there’s no possible way to lose data. While it is true that Microsoft and other cloud hyperscalers offer data center resilience and protection from failures far beyond that of anything private organizations can hope to build in-house, there are still significant risks. For instance, end-user deletion and ransomware can cause data loss just as quickly in SaaS environments as they can on-premises. Microsoft and most other cloud service providers operate under what they refer to as a shared responsibility model. This shared responsibility model obliges customers to protect their own data, and ultimately, Microsoft and other CSPs cannot be held accountable for your data loss.
Considering Microsoft has millions of customers, all making use of API calls to the various Office 365 backend applications, Microsoft limits the amount of data that users can restore in a specific time frame. This ensures that one tenant in Office 365 will not cause performance issues for other tenants in the same data center, region, etc. That said, if you wind up needing to restore large amounts of data to Office 365 very quickly, these built-in restrictions will dramatically impede the process.
In short, the responsibility for protecting and backing up your sensitive SaaS data ultimately lies with you and you alone.
New Rules for SaaS Backup
Organizations looking to protect – and if necessary, recover – their data in Office 365 and other cloud SaaS environments must follow a new set of criteria for selecting backup solutions. According to DCIG, these include the following requirements:
- Proactive Prevention Against Data Loss Events – The need for backup and cybersecurity software to come together in cloud environments like Microsoft Office 365 is becoming more apparent. When looking at the restrictions imposed for API access, colossal data loss events like an Office 365 cloud environment ransomware infection could potentially take days, if not longer, to recover from, even if you have adequate backups. This highlights the importance of monitoring for the telltale signs of ransomware infections proactively, and using automated processes to stop attacks before they can affect your data. In this way, any potential data restores have as small a footprint as possible.
- Advanced Monitoring Capabilities – Monitoring for other types of security threats in your Microsoft Office 365 environment can help prevent large data loss events. Tracking data sharing and data access patterns and anomalies across your entire organization can shed light on cybersecurity issues before they lead to data loss. Again, proactive cybersecurity measures will help to ensure much smaller data recovery when and if you face the need in your environment.
- Highly Efficient Recovery Routes – Your organization’s backup capabilities play a significant role in the degree to which you can quickly and effectively recover your data. Your backup approach must allow for granular data recovery. Complete file recovery can result in mountains of unnecessary data and cause massive headaches and complexity. Searchable backups for granular file or email item reinstatement can help administrators find the specific data required for a successful recovery – no more, no less.
As more organizations turn to cloud SaaS environments to reimagine business operations in a post-COVID world, robust backup capabilities and cybersecurity controls have never been more critical. Ransomware and other data loss incidents in the cloud will continue to grow in prevalence. Is your team equipped to identify, prevent and recover from a cloud ransomware infection without significant damage? Does your SaaS provider limit or throttle the amount of data you can restore within a specific timeframe? Are your backups stored outside of your cloud environment to preserve close control in the event of a catastrophic failure? If these questions make you the least bit uneasy, it’s time to change your strategy for managing and backing up your cloud environments to ensure your SaaS data is safe and recoverable at all times.
About the Author
Dmitry Dontov is the CEO and Chief Architect of Spin Technology, a cloud data protection company based in Palo Alto, and the former CEO of Optimum Web Outsourcing, a software development company from Eastern Europe. As a serial entrepreneur with over 20 years of experience in security and team management, Dmitry has a strong background in the cloud protection field and is an expert in SaaS data security. Learn more here: https://spin.ai.
