"Person of Interest," a science fiction television series that aired from 2011 to 2016, centers around a supercomputer known as "The Machine," designed to predict terrorist acts by monitoring and analyzing surveillance data. However, its capabilities extend far beyond its primary function, touching on themes of privacy, artificial intelligence, and the ethical implications of surveillance.
As "The Machine" processes and stores vast amounts of sensitive information, the series showcases the elaborate measures taken to protect this data from various threats, drawing a parallel to the real-world necessity of securing backup and recovery systems.
The security of "The Machine" and its data is paramount. The show illustrates the lengths to which the characters go to protect the integrity and confidentiality of the data, emphasizing the necessity of implementing robust security measures. This mirrors the crucial practice in cybersecurity of ensuring that backup data, serving as a recovery point in case of data loss or corruption, is afforded the same level of protection as the original data.
This safeguard emphasizes the importance of protecting backup data with the same level of security as the original data. It involves implementing measures such as encryption, access controls, and storing backups in secure locations, potentially offsite, to prevent unauthorized access or modification.
Pros:
- Ensures Recovery: Protecting backups guarantees the ability to restore systems and data, even if attackers target the backups
- Compliance: Aligns with industry regulations (e.g., HIPAA, PCI DSS) that often require backup protection
- Peace of Mind: Knowing that the last line of defense is secure provides confidence in times of crisis
Cons:
- Complexity: Adding security measures to backup management can increase complexity, especially when using different encryption or access control methods than those for primary data
- Potential Costs: Secure storage solutions and encryption may result in additional expenses
- Overconfidence: Strong backup protection must be complemented with other safeguards; it should not be relied upon as the sole failsafe
Here’s a link to the Data Recovery Policy Template provided free of charge from the fine folks at the Center for Internet Security: https://www.cisecurity.org/insights/white-papers/data-recovery-policy-template-for-cis-control-11
Here are some details on this specific Control/Safeguard. If you want more detail, DM me.
CIS Control 11 – Data Recovery
Establish and maintain data recovery practices sufficient to restore in-scope enterprise assets to a pre-incident and trusted state.
Implementation Group 1
CIS Safeguard 11.3 - Protect Recovery Data
Protect recovery data with equivalent controls to the original data. Reference encryption or data separation, based on requirements.