Everyone needs some tape
So normally, when writing a post for ‘Around the Storage Block’ blog, I’m writing to a timetable that is often set weeks in advance. HPE is a huge company and there are lots of contributors with articles to share about their particular piece of the HPE technology landscape. Per the schedule, the purpose of today’s post is to promote a new technical paper from Enterprise Strategy Group - and we’ll certainly come back to that in a moment - but first, I wanted to reflect on several news stories that caught my eye when I was preparing to write this blog entry.
AWS suffers a massive outage
The first is an incident that was reported in late November after Amazon’s AWS service suffered outages that lasted for many hours. These issues affected a wide range of businesses and brands that depend on Amazon’s cloud, with notable names including 1Password, Adobe Spark, Autodesk, Glassdoor, Flickr, Pocket, Roku, and The Washington Post. The website, Downdetector.com, showed spikes in user reports of problems with many Amazon services throughout Wednesday 25th November. Although Amazon was able to fully restore service levels by the following day, its AWS clients – and their end users – were temporarily prevented from using cloud-based internet services until the situation was resolved.
Bad things happen to good computers – including those owned by CSPs
Leading CSP named in 23 class action lawsuits
The second story I wanted to share is about cloud services provider, Blackbaud. You might remember that back in May 2020, Blackbaud intercepted a serious ransomware attack that sought not only to disrupt Blackbaud’s own infrastructure, but also tried to encrypt and misuse the data of its customers, who include charities, non-profits and leading international universities. The company said that it had blocked the attackers from completely encrypting its systems but not before they stole “a copy of a subset of data” from a self-hosted environment. Blackbaud paid the ransom demand after confirming the cybercriminals had destroyed the stolen data. Unfortunately, the matter didn’t end there and just this month Blackbaud reported that it was now defending 23 putative class action lawsuits linked to the May ransomware attack.
Walking the walk: how Spectra Logic beat ransomware using tape
Finally, tape library manufacturer, Spectra Logic, has just revealed it was the victim of a ransomware attack in May, which culminated in cybercriminals making a $3 million demand for payment to unencrypt files. What saved Spectra, in what is a perfect example of “walking the walk” was the fact that the company had extensive backups stored safely on LTO tape behind a ransomware-proof airgap. According to Tom Coughlan, writing in Forbes:
“It took Spectra Logic 3 to 4 days to check and clear the ransomware infections. Data recovery efforts were about 99.5% effective with 70% data recovery to the prior day and 20% additional recovery to the week before. One substantial system had its data recovered from a month prior.”
Spectra Logic’s data recovery efforts were 99.5% effective thanks to LTO tape
So what’s the ‘moral’ of these stories? Don’t use the cloud, always trust tape? Not at all. Although convenient, that would be entirely the wrong conclusion to draw from these headlines. The cloud gives businesses the ability to scale new apps and capabilities, greatly simplifying IT. It acts as a catalyst for new business models, new experiences, and new efficiencies in every industry. The necessity of the cloud is not open to question, not by HPE and certainly not by me as a tape storage specialist.
Believe the impossible can happen – and safeguard for when it does
And yet.
That subheading above refers to one of the famous ‘laws’ of future innovation defined by the British science fiction author, Arthur C. Clarke. One of these adages reads thus:
“When a distinguished but elderly scientist states that something is possible, he is almost certainly right. When he states that something is impossible, he is very probably wrong.”
It’s tempting to seek “one size fits all” solutions to the threat of cybercrime. And from a business point of view, there has to be a cost versus risk trade off when considering different scenarios – how likely is it that X will happen? But as the examples above demonstrate, even solutions and services that seem very secure can be prone to failure.
Any sufficiently advanced technology is indistinguishable from magic!
Another of Clarke’s maxims is that “any sufficiently advanced technology is indistinguishable from magic”. And sometimes, I think we place too much trust in cloud-based technology and forget the physical realities that lie beneath its miraculous abstraction. The cloud is not a cloud. It’s a network made up of different technologies - compute, storage, infrastructure, software - all of which have a key role to play and none of which are infallible.
So if there are lessons to be learnt from these three news stories, perhaps I can summarise them in three ‘laws’ of my own
- Bad things will always happen to good computers in spite of every effort made to prevent them.
- Your cyberdefences are only as effective as the weak spot that nobody has yet discovered. It is inevitable criminals will find a way in.
- Therefore, everyone needs some tape.
Okay, I admit that last one may raise an eyebrow. But in some respects, Andrew’s Third Law is the proof for the other two. The AWS outage wasn’t necessarily related to storage specifically; it simply illustrates that there has to be another layer of data protection beyond the cloud. If something as gigantic and central to the whole Internet as AWS can suffer downtime, then just about anything can be regarded as a potential point of failure. Nothing is impossible.
Meanwhile, the situation at Blackbaud shows that CSPs are just as vulnerable to crippling ransomware attacks as their clients, and may even be targeted precisely because they give criminals additional opportunities for exploitation. If you are hit by a ransomware attack, and depend on your cloud provider to restore your backups, who you gonna’ call if they also have ghosts in their machine? Not Dan Akroyd and Bill Murray, that’s for sure!
As Spectra Logic’s experience shows, keeping copies of your data offline behind LTO tape airgap is perhaps the ultimate ghostbuster. Ransomware can’t infect what it cannot reach - but that won’t stop criminals from trying. Bitdefender's ‘Mid-Year Threat Landscape Report 2020’ reported a 715% year-on-year increase in detected – and blocked – ransomware attacks. This is why the UK’s National Cyber Security Centre formally advises audiences in its ‘Annual Review for 2020’, that:
“a good first step to avoid being a victim is making offline backups of data. The criminal will hold less power over an organisation or individual if they already have copies of the thing they are trying to withhold.”
So let’s close on the technical paper I mentioned in my introduction. Entitled “In the Zettabyte Era, All Roads Lead to Tape”, the technical paper is a summary of the key benefits of HPE StoreEver LTO technology - benefits that ESG believes are unrepresented or simply unreported.
The value of tape is not only defined by its cybersecurity credentials; from the perspective of cost, its potential for future capacity growth, its role in compliance and sustainability, ESG’s report highlights how HPE StoreEver tape can make a strategic contribution to helping you transform your IT operations. And with LTO-9 solutions reaching the market in 2021, tape will remain a viable and vibrant sector for distributors and resellers to focus on. Other research from ESG published by the LTO Program reports that 89% of current tape users plan to increase or maintain their current tape footprint. Tape isn’t going to be rendered obsolete any time soon. As recent events prove, its relevance and utility have never been more apparent.
Remember Andrew’s Third Law. Everyone needs some tape!
Sources:
1 https://www.independent.co.uk/news/world/americas/amazon-web-services-outage-cloud-b1762074.html
2 https://www.bleepingcomputer.com/news/security/blackbaud-sued-in-23-class-action-lawsuits-after-ransomware-attack/
3 https://www.forbes.com/sites/tomcoughlin/2020/11/29/data-backup-practices-can-thwart-ransomware/?sh=cd4134d36bf7
4 https://www.bitdefender.com/files/News/CaseStudies/study/366/Bitdefender-Mid-Year-Threat-Landscape-Report-2020.pdf
5 https://www.ncsc.gov.uk/files/Annual-Review-2020.pdf
6 https://www.lto.org/esg2020/