<figure><img alt="brooklyn-pc-clinic-logo" src="/no-image-to-display.jpg" /></figure>Macrium spoke to Mike Jonas from <a href="http://brooklynpcclinic.com/">Brooklyn PC Clinic</a> in New York who offer computer repair and support services to home and businesses.Mike has been installing Macrium Reflect on home and business user’s computers for some time now and is very complimentary about the popular backup and recovery solution.“I love Macrium Reflect. It always works for me and most importantly of all, I trust it to work every time”.Mike works with a number of small businesses and residential users and spends a lot of time trying to educate his customers on the value of backing up their data. Sadly, they often don’t realise the importance until it’s too late.Mike has used a number of other backup solutions in the past, but finds that Macrium Reflect has more things going for it. “The other solutions can be a bit hit or miss and I was never 100% confident that they were doing their job. In particular, Reflect’s bootable rescue media has been a great tool for repairing Windows boot problems and has got me out of many a hole in the past!”Mike particularly likes the differential backups.“Whatever the developers did, they’ve done a great job! Macrium has saved me hours rather than having to go back and restore factory images. Macrium always makes me look good with my clients!”

Macrium spoke to Mike Jonas from Brooklyn PC Clinic in New York who offer

Helping Brooklyn PC Clinic look good with their clients

User-macrium-icon-white.svg

large_CompanyLogo.PNG

medium_CompanyLogo.PNG

small_CompanyLogo.PNG

thumbnail_CompanyLogo.PNG

CompanyLogo.PNG

Buy Now

Workstation

Server

Server Plus

Site Manager

MultiSite

Virtual Server

SiteDeploy

Deployment Kit

Macrium Reflect Home

Upgrade License

Renew Support

Technicians License

Protect your documents, data and operating systems using our advanced disk imaging technology.

Products

Disaster Recovery

Ransomware Protection

Scalable Backup

For OEMs

Find out how Macrium products can help solve your problems.

Solutions

Submit a Ticket

About Macrium Support

My Order History

Upgrades

Renewals

Forum

Knowledge Bases

Our dedicated Support Team are ready to help with any technical issues or problems with Macrium Reflect.

Support

Find a Reseller

Find a Distributor

Become a Partner

Become an MSP

Reseller Log In

Reseller Registration

Find a Macrium Reseller or become a Macrium Partner.

Partners

Contact Us

Our Story

Resources

Media Pack

Careers and Culture

Blog

We’re dedicated to creating dependable software, providing quality service, and maintaining superior relationships with our customers and partners. 

Company

Social icon-1.svg

Social icon-3.svg

Social icon.svg

Social icon-2.svg

Social icon-4.svg

cybersecurity

# What do we know about Windows 11’s security strategy?

_And more importantly, will it work?_

In previous posts [here](/blog/will-macrium-reflect-work-on-windows-11-63dc8e81b865) and [here](/blog/what-to-do-before-you-upgrade-to-windows-11-eab85153cf7a), we discussed how Macrium Reflect and Microsoft Windows 11 work together. In this article, we wanted to take a closer look at the new operating system itself, and what Microsoft’s choices indicate about their plans for what’s to come. But with many things, to get a clear picture of the future, one must briefly look at the past.

### Windows 10 Vulnerabilities

BeyondTrust, a company specializing in Privileged Access Management tools, recently released their annual Microsoft Vulnerabilities Report for 2020. The results were… not great.

> _“A total of 1,268 were reported, which marks a colossal 48% rise over the previous year (858). This is in fact the sharpest spike since the inception of the Microsoft Vulnerabilities Report, and means that, since 2016, total vulnerabilities have increased by 181%.” — [BeyondTrust](https://www.beyondtrust.com/blog/entry/microsoft-vulnerabilities-report "www.beyondtrust.com")_

In any system, in any structure, physical or digital, you’re only as strong as your weakest link. So what doesn’t come as a surprise in their report is how a large number of these exploits could be mitigated by simply removing certain administrative privileges. People — users — will always be the weakest point. BeyondTrust goes on to say:

> _“90% of Critical vulnerabilities in Internet Explorer would have been mitigated through the removal of admin rights_
> 
> _85% of Critical vulnerabilities in Microsoft Edge would have been mitigated through the removal of admin rights_
> 
> _100% of all Critical vulnerabilities in Microsoft Outlook products would have been mitigated by removing admin rights”_

It’s worth noting that these numbers have a double-edge. Microsoft products and services are the biggest in the market — over 1 billion people rely on Windows — making them obvious prime targets. At the same time, recognizing these exploits goes to show that the discovery and patching process is working exactly as it should. Shoring up the weakest link (users) seems to be a foundational pillar of Windows 11.

### Zero Trust

Up until now, Windows has largely operated on the Principle of Least Privilege (PoLP) when it comes to administrative access. Users are granted the least amount of access as is necessary for their job. For years, Microsoft encouraged users to shore up weaknesses in their security by actively using and maintaining admin rights. It’s fundamental to proper PoLP.

PoLP has been a foundation of computer security for decades. However, to work it needs constant care and vigilance from both software developers and users to be effective. Further, it makes the assumption that the platform (OS, firmware, hardware, storage, and network) upon which the application runs is itself secure. With the increasing value of data, threats to its security and increasing use of diverse computing resources, PoLP is proving insufficient to provide protection.

Zero Trust security is similar, but not exactly the same. The idea is to never trust anyone, anything, at any time. Or, [as Microsoft themselves say](https://www.microsoft.com/insidetrack/blog/microsofts-digital-security-team-answers-your-top-10-questions-on-zero-trust/ "www.microsoft.com"):

> _“Microsoft has adopted a modern approach to security called “Zero Trust,” which is based on the principle: never trust, always verify. This security approach protects our company and our customers by managing and granting access based on the continual verification of identities, devices and services.”_

But for various reasons, users mismanage or simply don’t bother with differentiating privileges, leaving entirely preventable gaps ready for exploitation. Like a parent enforcing stricter house rules for your own good, Microsoft has stepped in.

[Zero Trust policies](https://www.ncsc.gov.uk/collection/zero-trust-architecture/introduction-to-zero-trust "www.ncsc.gov.uk") are a new approach to secure system design that promise to deliver where PoLP cannot. In the simplest terms, it enables confidence and trustworthiness in a system to be established dynamically and continuously via a series of user and hardware verification (attestation) steps.

To execute Zero Trust verification and authentication, the platform must support a range of [Trusted Computing](https://en.wikipedia.org/wiki/Trusted_Computing "en.wikipedia.org") principles to enable a verifiably secure computing, storage and networking environment. Microsoft’s approach is to utilize the same protections used to securely separate hypervisor virtual machines along with a TPM device to provide a secure host for credential storage and operations.

As an aside, DRM implementers face a challenge; they have to embed the decryption key in all devices that can play the protected content. The most celebrated attack was probably the public disclosure of the DVD encryption key. Since then, they have been an early adopter of many Trusted Computing principles. For an example, see the [Protected Media Path](https://en.wikipedia.org/wiki/Protected_Media_Path "en.wikipedia.org"). Trusted Computing does raise a number of ethical issues, championed notably by the [EFF](https://www.eff.org/issues/trusted-computing "www.eff.org").

The hardware features for VBS have set the controversially high minimum hardware threshold for Windows 11. Limiting the CPU generation also eliminates a range of ‘side channel’ exploits.

To use MS nomenclature, Virtualization Based Security (VBS) provides a secure pathway in Windows 11 to implement some of the following:

*   “Kernel Data Protection” enables protection from rogue kernel mode software (drivers) from compromising the Windows kernel.
*   “Application Guard” utilizes VBS to isolate untrusted websites and documents and “Credential Guard” uses VBS to similarly secure access to credentials.
*   “Windows Hello Enhanced Sign-In” uses VBS to create secure pathways to external components like the camera and TPM when used for authentication.

These principles extend to Microsoft’s Azure ecosystem providing remote attestation features for cloud storage and computing resources.

Microsoft is clearly making an aggressive push to set the baseline for a secure computing platform. However, it remains to be seen how quickly the industry will upgrade both its hardware and the vast base of current applications and systems to utilize modern zero trust principles and services. In the meantime threat actors will continue to target the weakest link, whether that be legacy systems, legacy applications running on modern hardware, or social engineering techniques such as BEC.

It should also be noted that bugs in hardware protections will continue to be discovered and exploited, Meltdown and Spectre being two recent examples (more about that below); it is typically more difficult or impossible to patch such issues.

### From chip to cloud

In 2019, Microsoft announced Secured-core PCs as a proactive solution to growing firmware attacks, which are notoriously difficult to detect and remove.

> _“Secured-core PCs combine identity, virtualization, operating system, hardware and firmware protection to add another layer of security underneath the operating system. Unlike software-only security solutions, Secured-core PCs are designed to prevent these kinds of attacks rather than simply detecting them.” — [Windows Blog](https://www.microsoft.com/security/blog/2019/10/21/microsoft-and-partners-design-new-device-security-requirements-to-protect-against-targeted-firmware-attacks/ "www.microsoft.com")_

The concept of Zero Trust is now firmly rooted deep within the hardware of your PC, not just in the software that sits on top of it.

### Windows 11 hardware requirements

Given all the above, the [hardware requirements Windows 11](https://www.microsoft.com/en-gb/windows/windows-11-specifications "www.microsoft.com") demands make more sense. These demands mostly likely come in no small part because of [Meltdown and Spectre](https://meltdownattack.com/ "meltdownattack.com"), two computer processor security bugs discovered in 2018.

Patrick Moorhead, president and principal analyst at Moor Insights and Strategy spoke about it in a recent article in The Verge.

> _“Microsoft’s CPU selections for Windows 11 don’t appear much at all to do with performance but look like security mitigations for side-channel attacks.”_

The scale of these vulnerabilities honestly can’t be overstated — nearly every single device created over the span of decades was at risk. Even more, the problems were OS agnostic, but clearly Microsoft learned valuable lessons.

### Welcome to the real world

Sure, Microsoft is building upon an established foundation for future security steps, but it’s almost as though they’ve ignored conditions in the real world. Some of these were unforeseen, like the pandemic and subsequent supply chain issues, but they’re huge issues to contend with nonetheless.

*   Over [55% of enterprise workstations](https://www.lansweeper.com/itam/is-your-business-ready-for-windows-11/ "www.lansweeper.com") do not meet the requirements for automatic upgrades.
*   Manufacturers across all industries are experiencing a [global semiconductor shortage](https://www.bbc.co.uk/news/business-58230388 "www.bbc.co.uk").
*   [Millions of perfectly good](https://www.theverge.com/2021/6/29/22555371/microsoft-windows-11-cpu-support-hardware-requirements-tpm-response "www.theverge.com"), new(ish) PCs are suddenly “obsolete,” creating untold costs and waste.
*   The post-pandemic economy [has not completely recovered](https://www.brookings.edu/research/october-2021-update-to-tiger-the-global-economic-recovery-is-in-danger-of-stalling/ "www.brookings.edu"), and many firms are still keeping a close eye on their bottom line.

### Big leap? More like a small step

Given all these problems, it’s not surprising that Microsoft has stepped back slightly and announced that users can technically manually install Windows 11 on older PCs. As long as you have a 64-bit 1GHz processor with two or more cores, 4GB of RAM, and 64GB of storage — and you’re happy to do it — upgrading shouldn’t be a problem, even if you get some [scary warnings about possible “damage”](https://www.techradar.com/uk/news/windows-11-warning-mentions-possible-damage-to-unsupported-pcs "www.techradar.com") to unsupported systems. As it stands now, Microsoft will not offer updates or vital security patches to computers running Windows 11 that don’t meet the above CPU requirements.

 ![Windows 11 upgrade warning from The Verge.](https://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/20211013_what_do_we_know_about_windows_11s_security_fig_1_e06a8d4ccd.jpeg)

#### Windows 11 upgrade warning from [The Verge](https://www.theverge.com/2021/9/21/22686457/windows-11-health-check-compatible-supported-cpu-old-pc-waiver "www.theverge.com").

For the home and small business user who has a PC that ticks all the boxes, there is probably little practical security advantage in moving to Windows 11 at this time. The new features are either already available in Windows 10 (though not necessarily enabled by default or supported on all hardware) or only relevant in enterprise or highly secure environments. This stance may change if the Windows 11 enhanced kernel space protections prove resilient against a new class of exploit. The end of support date for Windows 10 may prove to be the biggest upgrade motivator for the security-conscious home and small business user.

What Microsoft is trying to achieve from a security perspective is commendable and certainly a move in the right direction. But considering the current issues of economic uncertainty, supply chain disruption, and the fact Windows 10 will be fully supported until 2025… it all sort of feels like much ado about nothing, for now.

And more importantly, will it work? In previous posts we discussed how Macrium Reflect and Microsoft Windows 11 work together. In this article, we wanted to take a closer look at the new operating system itself, and what Microsoft’s choices indicate about their plans for what’s to come. But with many things, to get a clear picture of the future, one must briefly look at the past.

What do we know about Windows 11’s security strategy?

# What Is the Advanced Encryption Standard? AES Explained

The beauty of digital encryption is that it keeps sensitive and private data hidden, even in the face of a ransomware attack or a data breach. Without the cipher, or key, to decrypt data, criminals aren’t able to decipher files. It’s one of the most basic elements of cyber security.

Today, the [Advanced Encryption Standard (AES)](https://www.techtarget.com/searchsecurity/definition/Advanced-Encryption-Standard) is the standard encryption method for industries and functions from retail to finance. 

At Macrium, we use AES to protect our users’ files from accidental deletion and malware, such as ransomware. So, we’ve put together this guide for those wondering how AES originated and became the encryption standard of choice.

## What Is AES?

AES is an algorithm developed by two Belgian cryptographers, [Vincent Rijmen](https://www.linkedin.com/in/vincent-rijmen-360911/) and [Joan Daemen](https://www.linkedin.com/in/joan-daemen-5921842/?originalSubdomain=nl). The duo submitted it in response to a call from the [National Institute of Standards and Technology (NIST)](https://www.nist.gov/publications/advanced-encryption-standard-aes) to the cryptography community. 

NIST challenged specialists in the field to create an updated encryption standard to meet the growing security needs of the 21st century. The previous standard, Data Encryption Standard (DES), developed by IBM in the 1970s, was failing to keep up with advancements in computing technology. 

AES was [formally adopted by NIST in 2001](https://www.cisa.gov/sites/default/files/2023-10/23_0918_fpic_AES-Transition-WhitePaper_Final_508C_23_1023.pdf). Today, it’s one of the most popular encryption standards around the world, thanks to its speed and security.

### Why Is It Important to Understand AES?

Since AES is one of the most widely used encryption standards, it’s important to know how it works to make informed decisions about data security and risk management. This is especially true for businesses in highly regulated fields that handle sensitive information, such as finance, healthcare and the military.

Most businesses and organizations must comply with industry and national standards, regulations and legislation regarding data security and privacy. Understanding AES can help them do so, reducing their risk of facing penalties or other consequences for failure to comply.

Finally, understanding the principles of AES and the protection it offers from hackers and attacks supports confidence in its reliability and provides peace of mind.

## How Does AES Work?

AES is a [symmetric method of encryption](https://geekflare.com/symmetric-encryption/), meaning the same key is used to encrypt and decrypt data. However, unlike older symmetric methods, AES splits data into blocks of 128 bits each. The blocks go through several rounds of different types of transformation, such as substitution, shifting, and transposition. 

This makes AES extremely secure from a brute-force attack. It presents a nearly incomprehensible number of possible combinations that [would take billions of years to decrypt](https://www.usnews.com/360-reviews/privacy/what-is-advanced-encryption-standard) using current computing power and technology.

AES uses key lengths of 128, 192, and 256 bits, with 256 being the strongest. Each goes through a different number of rounds.

![Macrium-Software-Table-AES-Explained Blog.png](https://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/Macrium_Software_Table_AES_Explained_Blog_caeabb6a7c.png)

Most applications use a 128-bit key length, while governments or other entities dealing with highly sensitive or classified information use 192-bit encryption as well as the 256-bit key length, which is often referred to as 'military-grade' encryption.

Why not use the 256-bit key length for everything? Because 256-bit encryption requires more computing power, which can drain power sources faster and use up a lot of resources. Plus, 128-bit encryption is more than adequate protection for the majority of applications.

## What Is AES Used For?

AES is integrated into many technologies we use for everyday functions, including:

- Wireless networks (Wi-Fi)
- Virtual Private Networks (VPNs)
- Password managers
- Programming language libraries
- File compression programs
- Mobile applications
- OS system components
- Hard drives
- Video games

This list gives you a good idea of how entrenched this encryption method is in our lives and our technology infrastructure.

## What Are the Advantages of AES?

AES has become one of the most popular encryption tools around the world thanks to its combination of relative simplicity and strength. Its top features include:

**1.) Easy Implementation -** The encryption process is easy for IT experts and teams to understand, making AES extremely accessible. 

**2.) Ample Support -** Developers and cyber security experts can call on a large support ecosystem, including frameworks, software libraries, manuals and other resources.
 
**3.) Speed and Efficiency -** Because it requires less memory than other methods, the algorithm quickly encrypts and decrypts data, making it suitable for use in fast-paced environments and meeting today’s expectations for speedy downloads.

**4.) Versatility -** The different key sizes offer flexibility in selecting the level of security for various applications. Plus, AES can be combined with other security protocols or types of encryption to provide an extra layer of security. 

**5.) Standardization -** AES has been widely accepted and endorsed around the world, supporting greater compatibility across platforms and systems. 

## The Future of AES

While the security and strength of AES have been proven many times over, the advent of quantum computing technology presents new challenges. NIST has already [announced several quantum-resistant algorithms](https://www.nist.gov/news-events/news/2022/07/nist-announces-first-four-quantum-resistant-cryptographic-algorithms) for potential future use. 

However, its experts are confident that AES will serve as a highly reliable encryption method for [decades to come](https://insights.samsung.com/2022/01/12/federal-government-leads-the-way-with-encryption-standards/). 

## How We Use AES to Protect Your Backups

At Macrium, our products can offer two main lines of defence against malware, such as ransomware.

Users of [Macrium Reflect](https://www.macrium.com/products/home) and [Site Manager](https://www.macrium.com/site-manager) and can opt to use AES encryption to protect their backup files. 

In addition, [Macrium Image Guardian (MIG)](https://www.macrium.com/mig) is a feature of Reflect, Site Manager and SiteDeploy. Granting write access only to Macrium tools, MIG blocks unauthorized modifications of your backup files. 

Together with the option to use AES encryption, these features make it virtually impossible for malware, such as ransomware, to access your backups. 

## Try Macrium Reflect for Free 

See MIG and our AES encryption options in action - download a free 30-day trial of Macrium Reflect for your [business](https://www.macrium.com/products/business/standalone/workstation) or for [home use](https://www.macrium.com/products/home#buy-reflect-home).

[Try Reflect for Free](BUTTON_SUCCESS=/products/home)





Your guide to the advanced encryption standard (AES), including where it originated and how it came to be widely adopted around the globe.

What Is the Advanced Encryption Standard? AES Explained

windows-backup

macrium

disaster-recovery

# Introducing Macrium Site Manager 8.1

We’re pleased to announce that we’ve made a series of improvements to Macrium Site Manager. The latest version, Site Manager 8.1, will be available for you to use from Wednesday 14th June 2023. This update improves the user experience and includes integrations for seamless use alongside other products.

## How do I Upgrade to Macrium Site Manager 8.1?
You’ll be able to update Site Manager from Wednesday 14th June 2023. When you log in, you’ll see a notice explaining some steps you need to take before doing so. Please note - The change is not automatic. You will need to actively opt into the update by clicking the button presented to you after login.

## What’s New With Macrium Site Manager 8.1?
Here is a breakdown of the improvements we’ve made since version 8.0.

### Speed Improvements
Macrium Site Manager 8.1 includes all Reflect 8.1 changes, including speed improvements.

### Macrium Boot Media Agent
- There’s now an automatic connection to the Macrium Site Manager server. This allows server-initiated restores and full monitoring and control of all rescue media-based operations.
- You can now restrict access to rescue media to specific users or groups using the permission management systems in Macrium Site Manager, including full active directory integration.
- Auto-repository mapping reduces time to manually restore backups using Macrium Site Manager rescue media. This removes the need for the user to manually map a repository and provide server paths, username and password (for logged-in users).
### Macrium SiteDeploy Integration
- Add license keys and start trials from the improved first-run wizard for both Macrium Site Manager and Macrium SiteDeploy.
### Simplify Disaster Recovery
- For disaster recovery from rescue media, computers can automatically be identified and backups for that computer can be listed directly in the Macrium Reflect restore interface, with no manual steps required.
### Improved Interface
- Improved computers page which gives you better visibility of repository usage and easier access to backups.
- Improved intuitive rules for partition selection makes partition selection easier than ever.
- The Macrium Site Manager initiated restore wizard has been updated to make the process of restoring a computer simpler and faster.
### Post-Backup Power-Saving Options
- Better management of out-of-hours backups, with added ability to shut down, reboot or suspend computers after backup completion. This is especially the case when combined with the existing Wake-on-Lan features in Site Manager.
Find out more about the upgrades in Macrium Site Manager 8.1 in our [video demonstration](https://www.youtube.com/watch?v=ZQRHp36T4fQ) and access the [release notes here](https://knowledgebase.macrium.com/display/MSM8/Release+Notes). 

We hope you enjoy exploring the benefits Site Manager 8.1 has to offer and encourage you to [share your thoughts](/contact) and feedback to assist with our continual improvement programme.

The latest version of our sitewide backup system, Macrium Site Manager 8.1, is now available for you to use. Here's the improvements we've made.

Introducing Macrium Site Manager 8.1

# Data disaster stories that'll keep you up at night

Data disasters come in all shapes and sizes, from personal to global. From fires and floods to theft and old fashioned human error, it can feel like they lurk in the shadows waiting to pounce.

It’s that time of year where it’s perfectly acceptable to gather loved ones in a dark place, hold a flashlight to your chin, and tell terrifying stories all in the name of fun. So if your old ghost, ghoul, and vampire stories are getting more eye rolls than goosebumps nowadays, these tales of data loss are sure to scare the bits and bytes out of them. 

## Rattling Blockchains

In 2013, James Howells made a mistake that will probably haunt him for the rest of his life. He threw out an old, unused hard drive that’d been sitting in a drawer for years, forgetting the drive held 7,500 bitcoins. He’s tried several times to get permission from his local government to excavate the landfill where the drive most likely ended up, offering a reward of [25% of the total value if they allow him to dig](https://www.bbc.co.uk/news/uk-wales-55658942 "www.bbc.co.uk"). 

At the time of writing, the price of bitcoin (BTC) is just over $62,000, making the lost fortune approximately $465,755,250. What a nightmare!

## Bump in the Night 

Imagine you’re a busy data analyst working for the Department of Veterans Affairs. Perhaps it was a dark and stormy night, but you had some work you needed to finish. As you’d done for years, you bring your unencrypted laptop home, complete your work, and head off to bed. But in the dead of night, a burglar [ransacks your home and steals the laptop](https://epic.org/privacy/vatheft/  "epic.org"). 

That laptop contained the personal information of 26.5 million veterans, information including Social Security numbers, birthdates, names, and even disability status. It also held the same information for over 2 million additional active duty military members. 

This is exactly what happened in 2006. The laptop was recovered and the VA says none of the information was accessed, but the consequences of what could have been are enough to send shivers down your spine. 

## Invasion of the Data Snatchers

1.1 billion. That’s how many people were potentially affected by one of the [world’s largest data leaks](https://www.zdnet.com/article/another-data-leak-hits-india-aadhaar-biometric-database/ "www.zdnet.com"). Aadhaar is India’s national ID database, and it holds a variety of incredibly sensitive data about nearly every citizen in the country. Biometric information like fingerprints and eye scans, what government services they use, even financial and commercial data is all attached to a 12-digit code. In 2017, a data leak from a state-operated utility company led to the exposure of all this info, some of it even ending up for sale on Whatsapp!

### The Library of Alexandria Massacre

In some context or another, you’ve most likely heard of the [fire that destroyed the Library of Alexandria](https://time.com/5912689/library-of-alexandria-burning/ "time.com"). For centuries we’ve lamented the loss of countless historical documents, wondered at the golden knowledge we could have built upon if it hadn’t been for such wanton destruction. 

Experts now say that the story, as we know it, is largely a combination of multiple historical events. The end result is an allegory that’s been used to teach many lessons throughout time, one of which is the importance of protecting knowledge and information we value most. The mere idea of its loss has been told as a scary story for hundreds of years. 

## 28 Days Later...

And for a data disaster that’s still unfolding, look no further than major broadcaster [Channel 4 in the UK](https://www.channel4.com/press/news/whats-happened-access-services-channel-4 "www.channel4.com"). A month ago, their broadcast center’s fire suppression system went off. Many British TV channels were temporarily affected, but because of an issue with C4’s data recovery, they lost the ability to offer access services like subtitles, audio descriptions, and sign language support. They had backups but their backups failed. It’s a frightening, and very public, reminder to practice the industry standard 3-2-1 backup strategy no matter how big or small you may be. 

## To be continued

If some of these scary tales chilled you to the bone, rest assured - they were all entirely preventable with the right data recovery plan in place. Now might be a good time to double check your backups, ensure you know what to do in case the worst happens, and get true peace of mind. It’s like turning on the lights and enjoying some Halloween candy after a good horror film!

And of course, if you’d like to chat with one of our experts to make sure you’re doing all that you can, [we’d be happy to help](/contact "Contact us").

Data disasters come in all shapes and sizes, from personal to global. From fires and floods to theft and old fashioned human error, it can feel like they lurk in the shadows waiting to pounce.

Data disaster stories that'll keep you up at night

# 2023 Data Disaster Horror Stories

This Friday the 13th, we’re taking a look at some of the biggest and scariest data disasters of 2023. But don’t let these tales cost you sleep at night! We’re also offering 20% off on Macrium Reflect Home Annual plans until Halloween. (And what’s the spooky season without some scary movies? How many references can you spot?)

## [3CX attacked in all new way](https://www.wired.com/story/3cx-supply-chain-attack-times-two "wired.com")

It's enough to make you Scream. State-sponsored attacks aren’t a new threat, but when a group associated with North Korea attacked VoIP company 3CX, they made history. Over half a million 3CX customers were affected thanks to a single employee’s PC being infected with a previously infected app. 

“This is the first time we've ever found concrete evidence of a software-supply-chain attack leading to another software-supply-chain attack,” says Mandiant Consulting's chief technology officer Charles Carmakal. “So this is very big, and very significant to us.”

Don’t Look Now, but this may be the first of many such events. 

## MGM Resorts and Caesars Entertainment

They’re heeeerrreee… Nope, it wasn’t a poltergeist in the slot machine, or a ghost in the elevator. Many sources point to ALPHV and Scattered Spider as the hacking groups who spun webs around two of the biggest casino resorts in the world, marking one of the biggest ransomware attacks in years. Not only were daily operations disrupted for days, the hackers were able to access personal information of many loyalty card members, including Social Security numbers. The MGM Resorts and Caesars Entertainment attacks have cybersecurity experts around the world doubling down on warnings about social engineering.

“[The hackers](https://fortune.com/2023/09/13/mgm-caesars-hacked-ransomware/ "fortune.com") first breached an outside IT vendor before gaining access to the company’s network…” 

Indeed, one of the most complex issues security pros face isn’t technical at all; it’s the end user. Technology like encryption and remote monitoring and management (RMM) has gotten so good, it’s becoming easier for hackers to target people themselves. Social engineering and phishing scams have always been consistent money makers for cyber criminals, but for a few days they made Las Vegas the Village of the Damned. 

## [UK Electoral Register](https://www.electoralcommission.org.uk/privacy-policy/public-notification-cyber-attack-electoral-commission-systems "electoralcommission.org.uk")

Get Out the Vote! While this one technically happened a few years ago, the public is only just finding out now. The United Kingdom's electoral registers fell victim to a “complex cyber-attack” which resulted in 40 million people’s personal information being compromised. Information like full names, email addresses, home addresses, and telephone numbers might not be critical info in of themselves, but if they were to be joined with other personal information gleaned in other ways, it certainly adds a few important pieces to the jigsaw puzzle that is our personal lives.  

## [Is AI already a hacking threat?](https://www.grantthornton.com/insights/articles/advisory/2023/anticipate-cybersecurity-and-privacy-risks-in-ai "grantthornton.com")

If 2023 tech had to be summed up all we’d need is two little letters: AI. A tsunami of hype and fear and speculation seemed to wash over all corners of the planet as ChatGPT and other AI platforms filled the social conversation. It really did seem like it was everywhere all at once. 

It’s not that an AI itself could start posing a direct threat (yet), but that its ease of use has made scamming so much easier for hackers around the world. Not only can they use AI to scale their schemes faster, but the software’s abilities help make the language they use in phishing emails sound native and natural. This means that even the most suspicious of us could fall victim, and parts of the world that have largely been ignored due to difficult language barriers are at greater risk. 

And all that’s not even touching on the Frankenstein’s Monster of Deepfake video and audio that looms in the future. 

## Natural disasters in the US

Beware The Fog and The Mist aren’t exactly threatening, but it’s important to note that not all data disasters are malicious. Natural disasters like fires, floods, earthquakes and hurricanes can have devastating consequences on life and property. But if data systems aren’t properly protected, that destruction may be even further reaching. 

From January 2023 to date, the United States alone has experienced over [23 separate billion dollar disasters](https://www.nytimes.com/2023/09/12/climate/billion-dollar-disasters.html "nytimes.com"). That’s over [$57 billion in damages](https://www.cnbc.com/2023/09/11/2023-severe-weather-57-billion-in-damage-and-253-people-dead-so-far.html "cnbc.com"), with a few months of the year left to go. As our climate changes and weather becomes more severe, it’s important to prepare for the unpredictable. 

## Avoid the Nightmare

If you’re ready to Let the Right One In and join millions of others who trust Macrium with their data, now is a great time to get started with our [Reflect Home Annual plan](/products/home). From now until October 31st, you can get your subscription for 20% off. That means you’ll get access to exclusive support, a free setup call with one of our team, all updates and fixes, plus entry to our customer forum and knowledgebase. 

And if you can’t get enough of the scary stories, be sure to check out our [previous posts](/blog?tag=halloween)!

This Friday the 13th, we’re taking a look at some of the biggest and scariest data disasters of 2023. But don’t let these tales cost you sleep at night! 

2023 Data Disaster Horror Stories

This Friday the 13th, we’re taking a look at some of the biggest and scariest data disasters of 2023. But don’t let these tales cost you sleep at night!

# How to avoid backup nightmares this Halloween

From accidental deletion to hardware failure, theft and malware, there are many ways to lose your valuable data aside from ghoulish foul play.

We have put together a few things to think about to help you setup your backup.

Remember, any backup is better than no backup; start off simple and optimise later but _do it today_.

## What should I backup?

You have two options. They have different attributes. Depending on what you want to protect choose either one or both for the following.

*   **Image** This will contain everything on your hard disk. If your disk fails or your computer is lost, you can use this to restore everything to new, booting hardware.  
    You can mount or open this backup file as a virtual drive and open or copy out file.  
    If you are using a compatible windows version, you can [instantly boot](/viboot) a backup as a virtual machine.
*   **File and Folder** This enables selective backup of folders or specific file types. For example, you may want to just backup your documents folder.  
    A file and folder backup is roughly analogous to a very high performance zip archive with the same Macrium backup features as for image backups.

## Where should I save my backups?

*   [**USB disk**](https://en.wikipedia.org/wiki/Disk_enclosure) This is quick and cost effective solution. You can also [rotate](https://knowledgebase.macrium.com/display/KNOW72/Alternative+Locations+For+Backups) two or more devices, keeping one in a separate location.
*   [**USB memory stick**](https://en.wikipedia.org/wiki/USB_flash_drive) These devices are fine for your bootable rescue environment, but are typically too small and too slow for efficient backup file storage.
*   [**NAS**](https://en.wikipedia.org/wiki/Network-attached_storage) This is more expensive than a USB disk but is more convenient; you have nothing to plug it, and you can share it between multiple computers.
*   [**Cloud**](https://en.wikipedia.org/wiki/Cloud_storage) Hosted remote storage removes the risk of hardware failure, fire, flood or theft. However, it is slower and can be prohibitively expensive for large files such as image backups.

You may want to consider a hybrid, storing large image backups on a USB disk and keeping a copy of your, smaller, file and folder backups of your documents in the cloud.

## When should I backup

Automate your backups with a [backup plan](https://knowledgebase.macrium.com/display/KNOW72/Scheduling+backups). A backup plan is a combination of a schedule, sequencing and maintenance of the backup chain (purging or consolidating the oldest backup points).

To simplify the process, Macrium Reflect Home includes predefined plans. Read more [here](https://knowledgebase.macrium.com/display/KNOW72/Scheduling+backups).

## How to keep your backups safe

*   **Fire and theft**: Rotate your backups, storing one device in an alternate location
*   **Malware**: Use [**MIG**](/mig) and apply all security updates
*   **Corruption**: [**Verify**](https://knowledgebase.macrium.com/display/KNOW7/Verifying+image+and+backup+files) your backups and make a 2nd copy
*   **Encyption**: Use AES to prevent anybody else accessing your data

## What to do when things go wrong

This is why we backup, and yet is often overlooked. There are three basic scenarios:

*   **Recover a deleted or corrupted file**: [Choose](https://knowledgebase.macrium.com/display/KNOW72/Browsing+Macrium+Reflect+images+and+backups+in+Windows+Explorer) a backup, [mount](https://knowledgebase.macrium.com/display/KNOW72/Browsing+Macrium+Reflect+images+and+backups+in+Windows+Explorer) it and copy out the file.
*   **My computer boots but something is broken** : [Choose](https://knowledgebase.macrium.com/display/KNOW72/Restoring+a+system+image) a backup, and select restore.
*   **My computer won’t boot :** In this case, don’t panic, you can [boot](https://knowledgebase.macrium.com/display/KNOW72/Restoring+an+image+from+within+the+Rescue+Media) your rescue media. This contains a number of tools to directly [fix booting issues](https://knowledgebase.macrium.com/display/KNOW72/Fixing+Windows+boot+problems) and restore an image backup to the same, or [new hardware](https://knowledgebase.macrium.com/display/KNOW72/Re-deploying+to+new+hardware).

It is important to test that you can boot your rescue media. Don’t forget to check that you can access your backups and your system volume (c:\\) from the rescue media. You should also check that you can mount a backup.

## Summary

If you only do one thing today, setup your backup. And [build rescue media](https://knowledgebase.macrium.com/display/KNOW72/Creating+rescue+media). OK, that is two things.

Please read the [KnowledgeBase](https://knowledgebase.macrium.com/display/KNOW72/) including the [quick start guide](https://knowledgebase.macrium.com/display/KNOW7/Macrium+Reflect+Quick+Start). We also have a range of [videos](https://www.youtube.com/@Macrium) illustrating common usage of Macrium Reflect.

### Buy Macrium Reflect Home

For a fully featured backup, you should consider purchasing [Macrium Reflect Home](/products/home).

From accidental deletion to hardware failure, theft and malware, there are many

How to avoid backup nightmares this Halloween

infosec

product

backup

# BackupFAQ — If my support expired does it affect my software licence?

**In this thread of #BackupFAQ blog post you can find answer to common questions we receive from our customers, where we explain all you need to know about Macrium Software, our Products and the Backup industry. Leave a comment if you have suggestions for our next publication.**

This week we explain how support works and how its renewal may affect your licence.

### [Macrium Support & Maintenance](/support)

### What does Standard support include?

Macrium Reflect business editions (Workstation, Server, and Server Plus for Exchange and SQL), all include 12 months free **Standard Support & Maintenance** included in the purchase of each license, which is renewable for subsequent years. Standard Support includes access to support **via email**, our KnowledgeBase and our customer forum.

We also offer a **Premium Support** option which includes priority response and telephone support.

Both Standard and Premium Support include **Upgrade Protection**, so Minor updates (for example v7.1 to v7.2) and Major upgrades (for example v7 to v8) are free while the subscription is current.

### What does Home Essentials support include?

When you purchase Macrium Reflect Home Edition, Macrium Home Essentials Support is provided free for one year.

Macrium Home Essentials Support includes access to support **via email**, our KnowledgeBase and our customer forum. Many problems can be solved by finding solutions within the Forum, KnowledgeBase (KB) Tutorials, Help Tutorials and YouTube videos; these are instant solutions rather than having to wait for Macrium Support to respond (usually within 24 hours during weekdays).

After the year of Home Essentials ends you will still have full and permanent access to our active and helpful customer forum and KnowledgeBase.

### Does Home Essentials support include upgrades?

Minor updates (for example v7.1 to v7.2) are free. Major upgrades (for example v7 to v8) are chargeable but with an upgrade discount — usually around 40% to 50% off the price of a new license.

### What is the difference between the Macrium Reflect Home Essentials Support and Macrium Reflect Standard Support?

Workstation licenses include eligibility for support when using Reflect in a business environment, which is explicitly NOT supported for users of the Home edition.

Workstation licences have Standard Support and Maintenance that can be upgraded to Premium 24x7 Support, and is renewable as an optional fee each year. It also allows you to get Major updates for free.

With the Home Edition, Essentials support cannot be renewed after 12 months unless a new license is purchased.

NB: 30-Day Trial users (of any edition) receive email support and we will answer any questions while evaluating our software for the full 30 days of the trial.

### What are the big differences between standard and premium support?

Both offer access to the Support Forum, KnowledgeBase, Upgrade Protection and remote support via email. But Premium support offers benefits that can be key when a disaster strikes: It offers the option of receiving Telephone Support, having Case Priority, 24x7 coverage and a typical response time of 12 hours instead of 24 hours.

### Do you offer email and Forum support for the Free Edition?

The free edition is not supported although users do have access to view the Forum, KnowledgeBase and YouTube videos. We have over 6 million users of Macrium reflect Free worldwide and there is no way we could provide support for a free product. Of course we hope the Free Edition will demonstrate the value of Macrium Reflect and result in people who are willing to pay for additional value. But if you want to keep using the free version, you’re welcome to do so: it is not time limited in any way (unlike the 30-Day Trial).

### How does the support renewal process work?

The Business Support and Maintenance subscriptions are for 12 months and must be renewed to retain access to support and maintenance. All business edition licenses without a current support subscription are eligible for an upgrade with a discount of up to 50%.

Any business edition of Macrium Reflect (Workstation, Server, Server Plus, and Technicians Licenses) that have a current support subscription, are eligible for a free upgrade to the current version. If the support subscription for a license expired within the last 90 days it is still possible renew it, so the license will be eligible for a free upgrade.

Home Essentials Support is for 12 months only and cannot be renewed, unless a new license is purchased.

Please note: the upgrade discount only applies to previous purchased versions, it does not apply when upgrading from the free or 30-Day Trial to the latest full purchased version.

### Will my licence still work if my support has expired and I don’t renew it?

Yes, Macrium Reflect Home, Workstation, Server, and Server Plus licenses are perpetual and independent of the support subscription.

Each Macrium Reflect Workstation, Server, and Server Plus Editions license key is for one computer and it should be only transferred to another computer for legitimate upgrade/replacement purposes. When you purchase any of these editions you have the software licenses for life, there is no annual fee to pay, independently of having renewed your support or not.

The exception is when you upgrade an old version to a current version. Your old license key becomes invalidated and replaced by the new upgrade license key.

### What about the Technicians and Deployment Kit Licenses?

These two license types run alongside the other business editions. These license are ideal for IT technicians or service companies who might maintain a large number of PCs and may wish to back them up prior to carrying out work. Without the Technicians License, each PC requires separate licensed copy of Macrium Reflect, because the usual licensing arrangement is machine specific. Using a Technicians license allows the technician to backup or image each PC using a single license.

The Technicians Deployment Kit License allows up to 5 technicians to create “Master” or “Golden” images and deploy them to an unlimited number of workstations and servers. This enables internal IT departments and commercial IT specialists to set up PCs without having to purchase a separate license for each workstation or server providing the software is not installed on more than one PC at a time.

The Technicians and Deployment Kit licenses last for one year, after which they can be renewed. If the subscription is not renewed they will downgrade to a standalone Server Edition license and Portable Application Support\* will no longer function.

Macrium Support & Maintenance is included with Technicians and Deployment Licenses, while the license subscription is active.

### What is Portable Application Support?

Portable application support ships exclusively with Macrium Reflect Technicians Licenses. In addition to allowing you to create a bootable USB stick from which you can rescue your systems, you can also optionally add Portable Application support to your media. This will allow you to run Macrium Reflect on your licensed PCs directly from the USB stick, without needing to install Reflect on the workstation or server first. The base install of Macrium Reflect may only be installed on a single PC at a time. If you wish to move this install, you will have to uninstall and reinstall the software.

We hope you have enjoyed this post. We will come back soon with more #FAQs updates.

You can download a 30-day Trial of [Macrium Reflect Workstation](/products/business/standalone/workstation) or [Site Manager.](/site-manager) Technical support for Trial users evaluating our software is available via [email.](/support)

In this thread of #BackupFAQ blog post you can find answer to common questions

#BackupFAQ — If my support expired does it affect my software licence?

# 6 best ways to love your data

It’s been said and repeated countless times, but data is the most valuable resource in the world. Your data. Everyone’s data. Companies are still clamoring to learn everything and anything about you to sell on to the highest bidder, hackers are hoping to get a valuable nugget for ransom leverage, and others are just collecting… collecting and waiting for a time when it can be best used. 

Sounds more like a horror story than a romance, but you aren’t powerless! There are a few important ways to show your data some love, and what better time to do it than International Love Data Week? 

## Check out these International Love Data Week events

First of all, let’s have a little fun and schedule in some great online events that are going on! Here are a few that jumped out, but be sure to check out [the complete list here](https://www.icpsr.umich.edu/web/ICPSR/cms/4544 "www.icpsr.umich.edu"). There are plenty of online and in-person events to choose from. 

[**Falling in Love with Data**](https://villanova.zoom.us/meeting/register/tJElcOmorzksGNT1cyET8YgVcX2yAOAnRLbu "https://villanova.zoom.us") - This beginner workshop will provide an overview of ICPSR, an online data archive available to social science researchers.

[**Dating with Data: 50 Years of Romantic Relationships**](https://calendar.lib.vt.edu/event/10275825 "calendar.lib.vt.edu") - How have US attitudes toward inter-racial, inter-religious, and LGBTQ+ relationships changed over the past half century? Find out what surveys from 1972-2022 say while sharing some Valentine's Day treats as part of International Love Data Week!

[**Love Data Week - Data Privacy**](https://library.temple.edu/events/1389 "library.temple.edu") - Learn about data privacy from Dina Gayanova, a data privacy and cybersecurity attorney in Holland & Knight's Philadelphia office.

[**Data for Social Good**](https://uncw.zoom.us/meeting/register/tZ0lcuCurTgrHtfdskbF47WpbT4f5Gap_kHO#/registration "uncw.zoom.us") - Data can be used to bring about changes that matter. Hear from various researchers about how they have used data to make an impact on society. They will reflect upon how they first recognized what impact their data could have, and how they then worked towards turning that data into a form to be practically used beyond academia.

**[Love Data Week: Introduction to Data Visualization with Tableau](https://library.temple.edu/events/1436 "library.temple.edu")** - Do you like data? Do you like good looking graphs? Do you like presenting information in eye-catching ways? If you answered yes to any of those, you might be interested in learning more about data visualization.

## Choose a privacy-focused alternative search engine

Google isn’t the only kid on the block anymore. There are new alternatives every day, but if you’re looking for an option that keeps your privacy front and center, why not give these a spin? Ecosia even plants trees the more you search! 

[DuckDuckGo](https://duckduckgo.com/ "DuckDuckGo.com")

[Startpage](https://www.startpage.com/ "www.startpage.com")

[Ecosia](https://info.ecosia.org/privacy "info.ecosia.org")

Disclaimer (and minor rabbit hole for you to fall into)

[Global surveillance alliances are an important](https://www.techspot.com/article/2515-surveillance-intelligence-alliances/ "www.techspot.com"), and sometimes invisible, piece of the cyber security puzzle. It’s important to educate yourself on your country’s laws and alliances, as all the good intentions a company may have are still subject to the law.

## Regularly check your app security settings

You’ve heard the saying, “If you’re not paying for the product, you are the product.” Luckily, in most jurisdictions, the law has finally caught up with technology and we’re now able to choose what information we share. The apps we love to use have a tendency to love using us back, but it’s important that all parties involved are okay with that trade.

So keep an eye on [your security settings](https://www.wired.com/story/how-to-check-app-permissions-ios-android-macos-windows/ "www.wired.com"), actually [read your EULAs](https://measuringu.com/eula/ "measuringu.com") (or at least give it a good college try), and take a few moments to consider what you’re giving in exchange for that “free” product or service.

## Learn about the most common cyber security threats

[Cyber criminals are constantly changing and adapting their techniques](https://www.ncsc.gov.uk/cyberaware/home "www.ncsc.gov.uk") for getting their hands on your info, but the absolute best protection against it: knowledge. Learn about the different ways your information can be accessed and stolen so it’s more obvious to you when you see it.

Even things as simple as keeping different passwords for different accounts, and turning on 2-factor authentication can go a long way.

## Best VPNs in 2023

This could be a blog post in itself (and probably will be soon) but we’d be remiss if it wasn’t included in this list. There are a variety of VPNs out there to suit your needs and price point, whether it’s just a browser extension or something for your whole household.

[TechRadar](https://www.techradar.com/vpn/best-vpn "www.techradar.com") has done a really great review of all the major VPNs out there right now, so have a read for the most current info and get started. Most offer free 30 day trials!

## Protect your data with backup and recovery software

And of course, rely on Macrium Reflect to protect your home PCs. Whether your data is compromised by hackers, lost due to human error, or destroyed due to a natural event, a well-planned backup strategy will protect you when you need it most.

Running regular backups is like a good insurance policy, and routinely checking you can restore them is the easiest way to trust your data is in good hands. And with [Macrium Image Guardian (MIG)](/mig), you can rest easy knowing that even your backup files are safe from ransomware.

![macrium-software-adoption-certificate-lovedateweek23.png](https://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/macrium_software_adoption_certificate_lovedateweek23_84a3327e78.png)

It’s been said and repeated countless times, but data is the most valuable resource in the world. Your data. Everyone’s data. Companies are still clamoring to learn everything and anything about you to sell on to the highest bidder, hackers are hoping to get a valuable nugget for ransom leverage, and others are just collecting… collecting and waiting for a time when it can be best used. 

Sounds more like a horror story than a romance, but you aren’t powerless!

6 best ways to love your data

Similar to the [federal government](/blog/the-federal-government-and-cybersecurity-risks "The Federal Government and Cybersecurity Risks"), state and local governments have cybersecurity threats. While the federal government is in charge of the U.S. as a whole, state and local governments manage cities, towns, tribals, and municipalities. This difference also leads to shifts in the way governments establish cybersecurity. On a state-to-state or city-to-city level, applications may change based on a number of factors. 

## What Does Cybersecurity Look Like on the State and Local Level?

State and local governments are vulnerable to cybercriminal activity as “they collect, process, store, and transmit vast amounts of sensitive data.” The wrong hands can weaponize and misuse data.

In 2020, hackers carried out 79 individual [ransomware attacks against U.S. government organizations](https://icma.org/blog-posts/practical-measures-local-government-avoid-ransomware "icma.org"). It cost downtime and recovery of nearly $18.88 billion. Clearly, ransomware is pervasive. The attack suspended “municipal operations, ultimately disrupting infrastructure services for 911 systems, utilities, and payment platforms with state and local governments.” 

[Cybercriminals target local governments](https://www.nlc.org/wp-contenthttps://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/2020/04/SML_2020Report_web-1.pdf "www.nlc.org"), which can “threaten to erode the trust that residents have in critical institutions.” The increasing reliance on IoT and automated systems may invite cyberattacks. They take advantage of gaps in security and the multiple entries of technology. Inadequate security measures and negligence within municipalities generate cyber risks.

![1406439_state-and-local-gov-graphic-3-2_071522.jpg](https://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/1406439_state_and_local_gov_graphic_3_2_071522_3fc6314d14.jpg)

From a [review of local government cybersecurity in 2020](https://icma.org/articles/pm-magazine/look-local-government-cybersecurity-2020 "icma.org"), local governments have three ways of cybersecurity structure: 

1.  **Centralized**: A single IT department is responsible for managing all the cybersecurity in a town or city. As a benefit, it ensures an extensive coverage of risks.
2.  **Decentralized**: Every department must run its own cybersecurity. Unlike centralized, a police department or building division in a town government must deal with IT matters individually.
3.  **Federated**: For local governments that operate with federated, it’s shared. The chief information security officer (CISO) assumes part of the authority for cyber protection. Local offices and departments take on the rest. The disadvantage of this model is that the CISO does not set the precedent for local government departments. A lot of breaches and cyberattacks can happen from a lack of education surrounding proper cybersecurity protocols. If a CISO is unable to totally control a local government’s cybersecurity, departments may be susceptible to hackers.

## Cybersecurity Preparedness

As with federal government agencies, local and state governments commonly take action post-attack. 

An example comes from the Riverside Ohio police and fire department in 2018\. The department servers suffered an unrecoverable data loss from 10 months of information. Unfortunately, it “effectively shut down the police department’s records management system.” Surprisingly, Riverside went through another data loss only a month after the initial shutdown. Since the first time, they ran daily backups in case it happened again, which it did. In March 2018 and May 2019, [two attacks occurred in the local government](https://icma.org/blog-posts/practical-measures-local-government-avoid-ransomware "icma.org") of the city of Baltimore as well. 

An [IBM news report](https://newsroom.ibm.com/2020-02-27-IBM-Survey-Only-38-of-State-and-Local-Government-Employees-Trained-on-Ransomware-Prevention "newsroom.ibm.com") examined the results from a poll. In it, U.S. city and state employees assessed their readiness for cyberattacks. Overwhelmingly, more than natural disasters and terrorist attacks, 73% of government employees feared “impending ransomware threats to cities across the country.” 

![1406447_stateandlocalgovgraphic1_071922.jpg](https://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/1406447_stateandlocalgovgraphic1_071922_969ebd5e0d.jpg)

Moreover, respondents revealed the prevalence of ransomware attacks. A poll showed that the departments of 1 in 6 employees had a ransomware attack. This evidence has not stimulated proactive prevention. Only 38% of employees received “general ransomware prevention training.” 

Along with cybersecurity structure in local government, there are obstacles to achieving uniform and effective cybersecurity across states, towns, and cities.

## Problems in Governments that Cause Cyber Risks 

Other factors contribute to the flaws in cybersecurity at this level of government. [IoT emerges as a feature in buildings](https://www.researchandmarkets.com/reports/5356053/global-smart-buildings-market-by-technology-ai "researchandmarkets.com") that will only continue, according to Smart Buildings Market for 2021-2026\. The research estimates that “over 78% of new construction will involve at least one facet of IoT and/or related smart buildings market-related technologies over the course of the next five years.”

More state and local governments will incorporate these types of technologies into their offices. "[T]hese internet-connected devices and systems greatly increase exposure to cybersecurity risks.” IMCA reviewed the [consideration for IoT safety in municipalities](https://icma.org/blog-posts/cybersecurity-considerations-implement-iot "icma.org"). They go in hand with the accessibility and streamlined application that IoT offers. Technology is not dangerous but a lack of cybersecurity resources is.

![1406375_stateandlocalgovgraphic1_071422.jpg](https://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/1406375_stateandlocalgovgraphic1_071422_91111930fa.jpg)

Risks for administering IoT devices:

*   Weak or hard-coded passwords
*   Old and unpatched embedded operating systems and software
*   Insecure data transfer and storage
*   Lack of secure updates

![1406389_state-and-local-gov-graphic-2-2_071822.jpg](https://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/1406389_state_and_local_gov_graphic_2_2_071822_43e47181bc.jpg)

The Center for Digital Government (CDG) surveyed 103 state and local officials to [determine why governments lacked an effective security strateg](https://www.govtech.com/sponsored/how-state-and-local-governments-can-make-their-security-operations-ready-for-the-future "govtech.com")y:

*   46% said lack of cybersecurity skills among their workforce
*   40% said issues with integrating security tools
*   36% said the inability to rapidly respond to threats

The following security and compliance challenges include: 

*   Legacy 
*   Unpatched and non-supported networks increasing exposure
*   Excessive manual processes 
*   Limited enterprise visibility around the endpoints connected to networks

From the survey, 66% of participants acknowledged that “their data-sharing practices are only somewhat mature or not mature at all."

Governments experience challenges with data accessibility and sharing. They have difficulty transforming data into actionable intelligence. It's a result of different data formats and storage environments. “At the same time, governments must deal with an ever-evolving regulatory environment and an increasingly privacy-focused landscape that makes it safer for them to limit data sharing rather than expose themselves to added risks.”

Data analytic challenges from a CDG survey:

*   41% said security
*   38% said privacy concerns
*   35% said data quality
*   34% said data silos

The article poses a few solutions:

*   Governments need to better align their data with people, technologies, and processes for the connection to be seamless.
*   Storing and indexing data calls for reconfiguration for security. 
*   Muncipilatites must leverage modern technologies to support data sharing across departments.
*   Cybersecurity is a necessity and data contains confidential information that demands protection. 

On top of this, 52% of state and local government IT/Security professionals agreed their budget hasn’t improved. This could hinder [training on ransomware prevention](https://newsroom.ibm.com/2020-02-27-IBM-Survey-Only-38-of-State-and-Local-Government-Employees-Trained-on-Ransomware-Prevention "newsroom.ibm.com/").

## What Regulations Constitute State and Local Cybersecurity? 

The EU implements the [General Data Protection Regulation (GDPR)](https://gdpr.eu/what-is-gdpr/ "gdpr.eu"), a data privacy and security law that provides regulations for organizations worldwide to control cybersecurity. Some states have begun implementing cybersecurity mandates on their own. Following this, the U.S. is starting to catch up with statewide mandates such as the [California Consumer Privacy Act (CCPA)](https://oag.ca.gov/privacy/ccpa "oag.ca.gov"). The act provides guidance for California businesses and organizations, mostly to protect consumers and let them have greater control over their personal information and what businesses can take advantage of. 

Additionally, the [2018 California Civil Code on Security of Connected Devices](https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201720180SB327 "leginfo.legislature.ca.gov") places a new requirement on manufacturers. On January 1, 2020, manufacturers began following these guidelines. IoT devices are now sold with the right security features to protect data and privileged information. The code will reduce "unauthorized access, use, adaption, disclosure, or destruction."

The New York City chief technology officer issued the New York City Internet of Things. It defines IoT safety and security practices. The new order creates processes to evaluate city technology. ICMA's “Cybersecurity Considerations to Implement IoT,” also gives recommendations for improvement.’”

The Committee on Homeland Security wants to introduce [The State and Local Cybersecurity Improvement Act](https://homeland.house.gov/imo/media/doc/State%20and%20Local%20Cyber%20Act%20Fact%20Sheet.pdf "homeland.house.gov"). The proposal stems from fears that the federal government is slow to cybersecurity. Stretched state and local budgets and current defenses cannot stand against foreign hackers.

The act develops "a new Department of Homeland Security (DHS) grant program." Advocates plan to tackle cybersecurity risks for state and local governments.

A National League of Cities report, “[State and Local Partnerships for Cybersecurity](https://www.nlc.org/wp-contenthttps://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/2020/04/SML_2020Report_web-1.pdf "www.nlc.org"),” believes in a collaborative approach. Cities and states can strengthen national cybersecurity infrastructure together. 

Currently, “Delaware is the only state that offers voluntary statewide cybersecurity training for state non-executive and local government employees.” Out of the 50 U.S. states, only 16 mandate cybersecurity training. Nine states lack cybersecurity training programs completely. 

Organizations are fighting to unify and structure the inconsistencies among states.

## How to Secure Critical Local and Government Data 

Beyond firewalls and antivirus software, a simple and inexpensive (compared to ransomware costs) solution is keeping backup images and copies of data. In this way, governments will have another layer of protection in case of ineffective cybersecurity. 

Security is central to software design at Macrium. Our applications give you complete control over where your data is stored and will operate fully offline for the most secure, air-tight networks.

Macrium Software provides extensive backup imaging for this reason.


State and local governments are vulnerable to cybercriminal activity as “they collect, process, store, and transmit vast amounts of sensitive data.” The wrong hands can weaponize and misuse data. In 2020, hackers carried out 79 individual ransomware attacks against U.S. government organizations. It cost downtime and recovery of nearly $18.88 billion. Clearly, ransomware is pervasive. The attack suspended “municipal operations, ultimately disrupting infrastructure services for 911 systems, utilities, and payment platforms with state and local governments.” 

State and Local Government Cybersecurity Risks

Here in the northern hemisphere, summer has rolled round again, bringing record temperatures across Europe and North America with it. While a cold shower or an icecream might be enough to cool us down, things aren’t so simple for the devices that we trust to store our data. Have you ever wondered why data centres are so cold? The answer is slightly more complex than “to keep the IT people cool”.

We all know that excess heat is bad for our devices. You may have even seen pictures or videos of competitive overclockers using liquid nitrogen to stop their CPUs overheating, and if you haven’t: [tomshardware has got you covered](https://www.tomshardware.com/reviews/how-to-competitive-overclocking-overclocker-tips,5636.html "tomshardware.com"). However, proper cooling isn’t just important for CPUs, it is also important for storage devices.

First, it can be beneficial to define what is a good temperature for a storage device. Although the exact numbers will vary from manufacturer to manufacturer, some basic outlines are

Solid State Drive (SSD) - 0 °C to 60°C (32°F to 140°F)

Hard Disk Drive (HDD) - 0ºC up to 70ºC (32ºF to 158ºF)

For more information you should read the manufacturer’s specification. This example is from a [Samsung 870 EVO](https://www.samsung.com/uk/memory-storage/sata-ssd/870-evo-1tb-sata-3-2-5-ssd-mz-77e1t0b-eu/ "samsung.com"):

![20220725-why-you-should-keep-your-data-cool-this-summer.png](https://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/20220725_why_you_should_keep_your_data_cool_this_summer_1f814025b5.png)

What happens if the temperature of the drives rise above this? Well, basically, nothing good. Many modern devices are smart enough to monitor their own temperature via their firmware. If temperatures reach a certain level, they may throttle their own performance to prevent further overheating. Whilst this is good as it prevents the drive from further overheating and potentially damaging components, this may also lead to reduced performance including reduced I/O performance. This [large-scale case study](https://users.ece.cmu.edu/~omutlu/pub/flash-memory-failures-in-the-field-at-facebook_sigmetrics15.pdf "users.ece.cmu.edu") of flash memory failure in the field at Facebook’s datacentres notes:

_“Higher temperatures lead to increased failure rates, but do so most noticeably for SSDs that do not employ throttling techniques.”_

Not only have they noticed a correlation between shorter flash storage lifespan with higher temperature, but drives that don’t implement performance throttling at higher temperatures had noticeably shorter lifespans than their counterparts that do.

In [this whitepaper](https://aiot.innodisk.com/wp-contenthttps://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/2020/07/Achieving-Extensive-Data-Retention-in-High-Temperature-AIoT-Applications-1.pdf "aiot.innodisk.com"), innodisk also draw a correlation between temperature and a decrease in data retention. 

_“Data retention decreases in higher temperatures and with increasing program/erase (P/E) cycles as both these factors induce a higher rate of charge leakage.”_

Charge leakage occurs when the dielectric barrier designed to trap a charge in the flash cell degrades, if the dielectric degrades too much, the cell can no longer hold a charge and thus can’t be programmed. For more information about the structure of NAND flash cells, I recommend reading [this blog post](/how-do-ssds-work#:~:text=SSDs%20are%20fundamentally%20made%20up,SSD%20and%20the%20host%20interface. "macrium.com"). Higher temperatures mean that charged particles in the flash cell move more, further eroding the dielectric layer. 

As for HDDs, [in this article by Backblaze](https://www.backblaze.com/blog/hard-drive-temperature-does-it-matter/ "backblaze.com") they indicate that in their datacentre there was no significant correlation between drive temperature and drive failure rate. In their ‘Hard Drive Temperature Takeaways’ they state:

_“As long as you run drives well within their allowed range of operating temperatures, keeping them cooler doesn’t matter.”_

However, this leaves a lot of room for speculation if the HDD exceeds the operating temperature, something that might not be that difficult as temperatures spike globally, and the average user does not have datacentre cooling to rely on.

The good news, however, is that there are steps we can take to help our storage devices out. Most methods to keep data cool may seem like common sense: from keeping devices away from direct sunlight, placing the device in an area with good air circulation, to avoiding heavy workloads in high temperatures and turning the device off when not in use; there are a lot of things we can do to reduce the temperature of our devices.

On the very hottest days, if you can’t keep your storage cool, just turn it off; that’s what Google and Oracle do.

[https://www.bbc.com/news/technology-62202125](https://www.bbc.com/news/technology-62202125 "bbc.com")

Keeping devices as cool as possible will not only prevent potential damage from overheating but many also improve data retention.


Here in the northern hemisphere, summer has rolled round again, bringing record temperatures across Europe and North America with it. While a cold shower or an icecream might be enough to cool us down, things aren’t so simple for the devices that we trust to store our data. Have you ever wondered why data centres are so cold? The answer is slightly more complex than “to keep the IT people cool”.

Why you should keep your data cool this summer

company

# Macrium Software one of UK’s Best Workplaces in Tech™

[Manchester, UK] The 2023 UK’s Best Workplaces in Tech™ list has been launched by Great Place To Work® UK, recognising Macrium Software among the list of organisations in the Small and Medium category.

Macrium Software’s employees anonymously reported that innovation and collaboration within the business make the company a great place to work.

> “The company culture is extremely friendly, I always feel comfortable going to my colleagues for help. Hard work is definitely recognised and management appreciates the extra effort that's made. I have felt extremely welcomed when working with different departments and have always been given help and resources when needed. It's a really nice feeling to enjoy working and knowing that I can ask for help if it is needed!”

An employee survey comment

## Great Place To Work® UK - Best Workplaces in Tech™️ list 

Now in its sixth year, the Best Workplaces in Tech™️ list celebrates companies adept at developing dynamic, collaborative cultures that serve as a catalyst for innovation and personal growth for all.
Great Place To Work® UK administered its research-backed Trust Index© employee survey and analysed the responses of UK-based tech employees to determine the Best Workplaces™ list.  

The surveys asked employees to comment on how their company supports their work-life balance, sense of fulfilment, job satisfaction, psychological safety and financial security. 

Evaluations also included an assessment of how well the organisation was able to deliver consistency of employee experience across all departments and seniority levels. 

Macrium Software is one of just five businesses in the North West to make the 2023 list in the category. The business also received Great Place to Work’s certification and featured on its .. lists earlier in 2023. 

## People are “Our Greatest Asset”

Macrium Software’s CEO, Nick Sills, said:

> “At Macrium Software, we recognise that our people are our greatest asset. We take great pride in fostering a supportive and positive working environment, where each individual can thrive and reach their full potential. We believe that by investing in our employees' professional and personal development, we can achieve the highest levels of success and innovation as a company. As a team, we are dedicated to creating a culture that values collaboration, creativity and mutual respect and we are committed to providing our employees with the resources they need to excel both in and outside of the workplace.”

## Keeping People “At the Heart of the Business”

Benedict Gautrey, Managing Director of Great Place To Work® UK said:

> “The Best Workplaces in Tech™️ list is created using the anonymous feedback collected from employees within the technology industry about their workplace experience. In one of the country’s fastest-growing industries, it’s fantastic to see these Tech organisations putting their people strategy at the heart of the business and implementing policies, practices and programmes that sustain an impactful and consistently great employee experience for all. A huge congratulations to Macrium Software for making one of our most prestigious lists.”

---ENDS---

### About Macrium Software 

Macrium Software is the industry leader in image-based backup and recovery software. We’re a vital part of digital security and business continuity plans for enterprise businesses, SMBs, and IT professionals across all industries and sectors. In a world where data is the most valuable resource, we've made it our business to protect yours. 

[www.macrium.com](/)

Follow Macrium Software online: [Twitter](https://twitter.com/macrium), [LinkedIn](https://www.linkedin.com/company/paramount-software-uk-limited), [Facebook](https://www.facebook.com/macrium/), and [YouTube](https://www.youtube.com/macrium/)

© 2023. Paramount Software UK Limited. Macrium Reflect® is a registered trademark of Paramount Software UK Limited. 

### About Great Place To Work®

Great Place To Work® is the global authority on workplace culture, on a mission to make every company a great workplace for all. Every year, they receive direct feedback from over 10 million workers around the world telling us how they really feel about their employer. 

Their survey is completely confidential and anonymous, so people can feel comfortable to be honest about their workplace, and companies can gain detailed insights into how they can better serve their people.

Only those employers who have the highest levels of trust, job satisfaction, and who empower ALL their employees to thrive both in and outside of work are awarded official Best Workplaces™ recognition.

For more information, visit [www.greatplacetowork.co.uk](https://www.greatplacetowork.co.uk/)

Macrium Software has been named as one of the UK's Best Workplaces in Tech™ by Great Place To Work®, the global authority on workplace culture.

Macrium Software one of UK’s Best Workplaces in Tech™

# What is Data Exfiltration and How Can it Harm Your Business?

When it comes to ransomware, most decisionmakers focus on reversing malicious encryption. However, hackers know when they're on to a good thing. If a victim will pay a ransom once, why not twice?

In addition to attacking and encrypting backups, recent ransomware introduces another feature - [exfiltration](https://csrc.nist.gov/glossary/term/exfiltration).

## What is Exfiltration?

Traditionally, exfiltration means ‘to withdraw (troops or spies) surreptitiously, especially from a dangerous situation'. But in 2024, what does that have to do with your data?

As well encrypting data, certain ransomware variants, like MountLocker, Nefilim and DoppelPaymer, also export data from an infected network. Data is copied and sent to a remote server controlled by the ransomware gang before encryption begins. The process is silent and largely invisible, hence ‘exfiltration’.

## How Does Exfiltration Harm Your Business?

Ransomware threat actors are out to make money from their victims. Which means that the effects of exfiltration are always harmful. Here’s a few to consider:

### Double Extortion

The main reason for data exfiltration is to potentially double the size of ransom payouts. In a double-extortion attack, victims are first asked to pay a fee to access the decryption key for their data. Once paid, they are then informed that the hackers have also acquired sensitive data belonging to their victim. If the victim wants the data returned, they must pay a second ransom.

What happens if you don't pay the ransom? [Hackers may sell the data](https://www.bbc.co.uk/news/entertainment-arts-67544504), or leak it online. And there is always a risk they will do it anyway, even after receiving a second ransom payment.

### Regulatory Breaches

When exfiltrated data contains personally identifiable data (PID), your business may be prosecuted by data protection authorities. Regulatory breaches [can carry stiff penalties](https://ico.org.uk/for-organisations/law-enforcement/guide-to-le-processing/penalties/), with fines reaching £17.5 million or 4% of global turnover. 

Cyber security insurance may offset some of the headline costs, but coverage may vary.

### Compromised IP

Aside from PID, your business holds plenty of confidential information. Among the highest-value - to both you and hackers - is any intellectual property (IP) your business owns.

[Stolen IP](https://www.cps.gov.uk/legal-guidance/intellectual-property-crime) may be sold to unscrupulous competitors or leaked online. And once that's out in the open, you can't put the genie back in the bottle. 

Your IP can be used by competitors to improve their own products. Should this happen, the effects on sales and revenue could be catastrophic. You may have to pull product lines and features and may experience a loss in competitive advantage or market share.

### Damage to Reputation

Data breaches of any kind will dent customer confidence. 69% of people would avoid a company that had suffered a data breach, even if it offered a better deal than competitors. And 29% said that if their data was compromised, [they would never use that business again](https://www.verizon.com/about/news/what-customer-experience-do-consumers-really-want).

Restoring trust after a data exfiltration event is costly, may take considerable time and is likely to result in customer complaints and losses.

### Class-Action Lawsuits

Some customers may go further than a simple boycott. Individuals may seek financial compensation through the courts, suing your business for allowing data to be exfiltrated. In some jurisdictions, particularly the US, you may find yourself on the receiving end of a class-action lawsuit.

If the courts find your business liable, the penalties can be substantial. And that's on top the fines already levied by data protection authorities. With this in mind, it's little wonder that the total cost of ransomware attacks [can run into millions](https://www.theguardian.com/technology/2023/may/10/ransomware-payments-nearly-double-in-one-year).

### The Damage Data Exfiltration Can Cause 

While hackers are only concerned with securing a second payout, the knock-on effects of ransomware data exfiltration are significant. For businesses with no or ineffective backup strategies, recovering data following a ransomware infection can take weeks. Operations and productivity will be negatively affected throughout.

But it's the longer-term challenges that may have the hardest negative impact. Regulatory fines for illegal data losses are unavoidable - and expensive. Lost market share may never be recovered, especially if your own IP is used against you. And the damage to customer trust will only make that task harder, reducing revenue for an extended period following a breach.

## How to Stop Ransomware Exfiltrating Your Data

There are two important points about ransomware-enabled data exfiltration. 

Firstly, the process is typically slow. Your IT team would quickly notice a series of very large data transfers to an unknown location and block traffic. This means that hackers must steal data little and often to avoid detection.

Secondly, because they can only take limited amounts, hackers will try to identify and target the most sensitive, valuable data they can. This tends to result in relatively small amounts of data being stolen and ransomed.

When it comes to ransomware data exfiltration, prevention is always better than cure. Securing endpoints against malware infection is a critical starting point. However, ransomware continues to infiltrate corporate IT defences, so you also need to be prepared.

Your next step is to have a robust [disaster recovery strategy](https://www.macrium.com/blog/how-ransomware-resilient-is-your-data-backup-strategy) in place. Being able to recover data quickly and reliably is critical to reducing downtime. It'll also play a pivotal role in helping to prevent the spread of ransomware inside your network.

Ultimately, accelerating recovery and containing spread will determine how much data hackers can exfiltrate. And as always, the less they can steal, the lower the impact on your operations.

## Join our Webinar: How To Protect Your Backups from Ransomware 

![How-To-Protect-Backups-From-Ransomware-Webinar-LinkedIn-Graphic-Macrium-Software.png](https://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/How_To_Protect_Backups_From_Ransomware_Webinar_Linked_In_Graphic_Macrium_Software_a0b89e1a3a.png)

Find out more about mitigating ransomware threats - join our webinar on Wednesday May 22nd at 14:30 BST (London) / 09:30 EDT (New York), when we'll welcome special guest speaker and cyber security expert [James Bore of Bores Group](https://www.bores.com/about) and offer practical guidance on keeping your backups safe from ransomware. 

**Secure your spot [here.](https://info.macrium.com/how-to-protect-your-backups-from-ransomware)**



A black and white photographic image of a gloved hand reaching out of a laptop screen and into a wallet, stealing money, to illustrate the title of the blog, what is data exfiltration and how can it harm your business?

What-Is-Data- Exfiltration-And How-Can-It Harm-Your-Business-Macrium-Software.png

Data exfiltration has become a feature of today's ransomware. Find out what steps your business can take to reduce the risks of it happening to you.

What is Data Exfiltration and How Can it Harm Your Business?

# 6 Ways to Build Your Ransomware Resilience

Ransomware attacks continue to pose a significant threat to businesses worldwide. Last year alone: 

- 59% of organizations were hit by ransomware 
- On average, 49% of an organization’s computers were impacted by a ransomware attack
- 94% of organizations hit by ransomware said that the cyber criminals attempted to compromise their backups during the attack 

[Source: 'The State of Ransomware 2024' - Sophos.](https://assets.sophos.com/X24WTUEQ/at/9brgj5n44hqvgsp5f5bqcps/sophos-state-of-ransomware-2024-wp.pdf)

With the prevalence and potentially devastating consequences ransomware can have on businesses of any size, it pays to consider what you can do to mitigate the threats this type of malware can bring. Here are our top six tips for making your operations more [ransomware](https://www.macrium.com/blog/how-ransomware-works-guide-for-small-businesses) resilient.

## 1. Develop and Implement a Disaster Recovery Plan

No matter how solid your IT platform and cyber security measures are, risk is ever-present. And it could come from a number of sources. A hard disk array failure, a ransomware infection or a weather-related disaster - anything that disrupts your business operations or brings about unplanned downtime.

A [disaster recovery plan](https://www.macrium.com/blog/reasons-your-business-needs-data-backup-recovery-plan) maps out exactly what you will do to resume operations in the face of a data loss event. Your plan must also address how you will prevent ransomware from infecting backups. And how you will prevent reinfection when restoring data from a backup.

Routinely testing your disaster recovery plan before you need it is vital. The worst time to discover a problem is in the middle of a disaster.

## 2. Use the 3-2-1 Backup Method

The 3-2-1 backup plan is one of the most popular backup strategies because it really works. The principle is simple:

3 – Always have three copies of your data
2 – Two different backup storage media (usually tape and/or disk)
1 – One copy of backed-up data stored off-site (possibly in the cloud)

The [3-2-1 strategy](https://www.macrium.com/blog/how-to-implement-the-3-2-1-backup-strategy) helps protect against modern ransomware which routinely targets backup archives. Two backup copies increases your chances of having a ‘good’ copy to restore from. And storing a copy offsite, preferably offline, further reduces risk of infection.

Immutable backups prevent archives being overwritten or compromised by ransomware. This is particularly important when using the automated file replication systems common in cloud backup systems.

## 3. Keep Software and Tools Updated

Anti-malware and mail filtering tools are only effective if they're kept up to date. Your IT team must ensure that definitions are routinely downloaded and applied. You may have the option to use automated signature updates. These can help to limit the risk of ransomware infection and spread.

Similarly, ransomware typically exploits known software vulnerabilities. Keeping your applications patched and updated is critical to reducing attack potential. Closing loopholes early will ensure ransomware can't spread. Developing a patch management schedule is time well spent if it prevents a costly ransomware outbreak.

## 4. Train Employees to Spot Cyber Criminal Tactics

Unfortunately, your employees are one of the most likely means of ransomware infiltrating your network. But with awareness and regular training, they could also become one of your most important and powerful defences. 

Employees alert to ransomware tactics are less likely to open attachments or click links, which can dramatically reduce the risk of infection. Very often there are warning signs - if they know what to look for. Among the most obvious indicators are:

- Poor spelling
- Low-quality or incorrect graphics
- Executable attachments
- Attachments containing macros
- Incorrect URLs and website addresses
- Requests to share usernames, passwords or other sensitive information
- Unusual requests from internal email accounts, such as account sharing or similar

Checking emails for any of these indicators should be routine practice for all employees. Checks don’t have to take long and they will save a lot of time and money if they prevent a ransomware outbreak.

## 5. Network Segmentation and Access Controls

Ransomware spreads and infects as many files as it can. Designing your network architecture to limit spread adds another layer of defence. Segmentation allows you to divide your network into smaller subnets and to control the traffic between them. When done correctly, network segmentation can prevent traffic crossing out of an infected segment. This instantly limits the damage potential of an infection.

Your systems also contain valuable tools to control access. Ensure that unknown applications can't be executed with elevated permissions. And prevent users from accessing resources they do not need. These basic principles ensure that even if ransomware does make it into the network, you can significantly limit its spread.

Segmentation is also a useful tool for preventing backups from being compromised by ransomware. Consider installing firewalls between network segments. You'll then be able to detect and block suspicious activity from crossing segments, even before an infection is confirmed.

## 6. Stay Informed of Evolving Cyber Threats

Ransomware, like other cyber threats, is constantly evolving. So making it a priority for your IT team to stay on top of the latest developments is always a plus. There are plenty of ways to stay informed, including:

- Reading and watching industry news
- Attending cyber security events
- Watching webinars on topical issues
- Connecting with industry peers and sharing knowledge, experience and best practice principles

Continually learning about ransomware and how it's evolving, then bringing this knowledge into the workplace, will help keep your business' assets, data and backups protected.

## Prioritize Proactive Ransomware Resilience 

Ransomware resilience is a non-negotiable requirement in a digital age. Your business must be ready to face - and mitigate - the threat of infection. Otherwise, the impact of an outbreak could be catastrophic. We hope these six tips will point you in the right direction to build a comprehensive defensive strategy that properly protects your business.

## Take Your Place in the Ransomware Conversation

Find out more about mitigating ransomware threats by joining our webinar on Wednesday May 22nd at 14:30 BST (London) / 09:30 EDT (New York), when we'll welcome special guest speaker and cyber security expert [James Bore of Bores Group](https://www.bores.com/about) to bring your practical guidance on keeping your backups safe from ransomware. 

[**Sign up here reserve your place.**](https://info.macrium.com/how-to-protect-your-backups-from-ransomware)








A monochrome photograph of a hand stacking building blocks with graphics in the background, to illustrate the theme of the blog post '6 ways to build your ransomware resilience'. 

6-Ways-To-Build- Your-Ransomware -Resilience-Macrium-Software.png

We offer six tips on how your business can build ransomware resilience, from implementing a disaster recovery plan to network segmentation. Read more. 

6 Ways to Build your Ransomware Resilience  |  Macrium Software

We offer six tips on how your business can build ransomware resilience, from implementing a disaster recovery plan to network segmentation.

6 Ways to Build your Ransomware Resilience

# How Ransomware Resilient is Your Data Backup Strategy?

When it comes to ransomware protection, backups are your last line of defence. But relying on scheduled backups alone is not enough to protect you against the threats posed by malware.

In this blog post, we take a look at some steps your business can take to ensure you're doing everything you can to protect your backups from ransomware.

## Ransomware is Targeting your Backups

Your business’ backup data is an attractive target for cyber criminals. With copies of your critical data and systems in their hands, they have the leverage they need to demand a ransom.

Additionally, your backups may not be adequately protected or segregated from your main network. This makes them easier targets for ransomware attacks. Once threat actors gain access to your network, they may quickly locate and compromise backup systems.

If they can successfully encrypt or delete backups, they can demand higher ransom payments. Businesses may be more willing to pay a larger sum if they believe their only alternative is to rebuild their systems and data from scratch.

Finally, if cyber criminals can access and compromise your backups once, they may be able to do so again. This creates an ongoing threat, as attackers can repeatedly target and extort you. 

## What Does This Mean For You?

When data backups become a target for attack, the potential effects of a breach increase. If backups are compromised, victims are [50% more likely](https://news.sophos.com/en-us/2024/03/26/the-impact-of-compromised-backups-on-ransomware-outcomes/) to pay a ransom.

Recovering after a ransomware attack involves time, effort and resources. If backups are compromised, time to recovery increases exponentially. Just [26% of compromised businesses fully recover](https://news.sophos.com/en-us/2024/03/26/the-impact-of-compromised-backups-on-ransomware-outcomes/) within a week. That’s [compared to 46%](https://news.sophos.com/en-us/2024/03/26/the-impact-of-compromised-backups-on-ransomware-outcomes/) of those whose backups were not infected.

Worse still, ransom demands escalate once criminals know their victim cannot recover data. This can see recovery costs [balloon to 800%](https://news.sophos.com/en-us/2024/03/26/the-impact-of-compromised-backups-on-ransomware-outcomes/).

## The Pitfalls Of A Cloud-Only Approach

Using the cloud to store backups is a great way to protect against accidental data loss. The cloud also meets the ‘offsite’ copy requirement of a good [3-2-1 backup strategy](https://www.macrium.com/blog/how-to-implement-the-3-2-1-backup-strategy). 

But when data synchronises to the cloud, you often copy ransomware and unrecoverable encrypted data into backups. The archived ransomware may not be 'live', but it will re-infect systems when restored.

## How to Build a Ransomware-Resilient Data Backup Strategy 

With backups being such a desirable target for ransomware threat actors, what can your business do to make sure your approach to data backup is as ransomware-resilient as it can be? The answer is to strengthen the security of your archives themselves - here's how. 

### Create Immutable Backups

Making backups read-only is an immediate and effective way to prevent ransomware infection. Creating immutable backups ensures your data is always an accurate reflection of your systems at that point in time.

With the right backup software you define immutability rules that govern when files can be updated or deleted. You also control backup set retention periods to prevent accidental overwriting. 

### Store Backups Offline

The 3-2-1 backup strategy recommends keeping one copy of your data offsite. Many organisations take this to mean in the cloud - and many cloud providers encourage that belief.

Yet the fact that data remains ‘online’ in the cloud means it is still vulnerable to ransomware. Storing backups offline, also known as ‘air gapping’, ensures that they can't be attacked or compromised remotely.

Immutability combined with offline storage reduces the risk of ransomware affecting your archives. Reliable backups are essential to restoring operations quickly following an infection.

### Optimise Your Backup Frequency

Another factor to consider when developing a ransomware recovery strategy is [data freshness](https://atlan.com/data-freshness/). Your backup is a point-in-time snapshot, which quickly ages as time passes. The longer between snapshots, the less fresh the archived data becomes.

By reducing time between snapshots, you limit the amount of work required during a restore. Fresher data limits the amount of rebuilding and overall recovery needed to resume operations.

Capturing and archiving your data more regularly will help to mitigate the effects of a ransomware event. In this way, regularity could also speed up time to recovery.

Immutability, air gapping and frequency are the foundations of a successful backup strategy. And not just when dealing with ransomware. Combining all three factors will allow you to manage any disaster recovery scenario successfully.

## Join our Webinar: How To Protect Your Backups from Ransomware 

Find out more about mitigating ransomware threats - join our webinar on Wednesday May 22nd at 14:30 BST (London) / 09:30 EDT (New York), when we'll welcome special guest speaker and cyber security expert [James Bore of Bores Group](https://www.bores.com/about) and offer practical guidance on keeping your backups safe from ransomware. 

**Secure your spot [here.](https://info.macrium.com/how-to-protect-your-backups-from-ransomware)**
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              

A hand holding up an umbrella as rain is pouring onto it to illustrate the question how ransomware resilient is your data backup strategy?

How-Ransomware-Resilient-Is-Your-Data-Backup-Strategy-Macrium-Software.png

Is your business' data backup strategy ransomware resilient? Here are actions you need to take to mitigate the threat to your business backups.

How Ransomware Resilient is Your Data Backup Strategy?

# 7 Ways Your Business Can Demonstrate Data Backup Compliance

As with most kinds of data that your business holds, your backups must be secured against loss, theft or misuse. And demonstrating data backup compliance is a task most businesses face, especially those in heavily regulated industries.
Evidencing that you follow best practice and have a data backup plan can go a long way to fulfilling many of the data protection laws and regulations out there today.

In this blog post, we’ll look at some of the backup compliance standards, laws and certifications that may apply to businesses like yours. Then we’ll outline seven data backup processes you can introduce to help your business meet these.

## Example Laws and Standards

The extent to which a business needs to demonstrate data backup compliance differs depending on a variety of factors, including industry and geography. Businesses in finance, healthcare, manufacturing or education, for example, may be bound by the following.

### GDPR

- **What?** The [General Data Protection Regulation (GDPR)](https://gdpr-info.eu/) is a comprehensive privacy law which applies to organizations that process the personal data of individuals residing in the European Union (EU).
- **Who?** This is regardless of where the organization itself is located. Therefore, it can apply across a wide range of industries and sectors. From eCommerce, marketing and technology to healthcare, hospitality, charities and NGOs.
- **Where?** Organizations processing the personal data of EU citizens.
- **The Cost of Non-Compliance?** Up to €20m or 4% of global turnover, whichever is higher.

### HIPAA

- **What?** The [Health Insurance Portability and Accountability Act (HIPAA)](https://www.hhs.gov/hipaa/index.html) is a US federal law that safeguards individuals' protected health information by establishing standards for its privacy, security and electronic transactions within the healthcare industry.
- **Who?** It applies to entities within the United States that handle protected health information, such as healthcare providers, insurance companies and third-party vendors or contractors acting on behalf of these.
- **Where?** USA
- **The Cost of Non-Compliance?** Fines range from $100 to $1.5m and could also include up to 10 years in jail depending on the circumstances.

### PIPEDA 

- **What?** [PIPEDA (Personal Information Protection and Electronic Documents Act)](https://laws-lois.justice.gc.ca/eng/acts/p-8.6/page-1.html) is a Canadian federal law that regulates how private-sector organizations handle personal information. PIPEDA requires organizations to safeguard personal information, provide individuals with access to it and allow them to challenge its accuracy.
- **Who?** PIPEDA applies to federal works, undertakings or businesses, non-profits and any private sector organization engaged in commercial activities in Canada. The exception is in provinces that have substantially similar privacy legislation (such as Alberta, British Columbia and Quebec).
- **Where?** Canada
- **Cost of Non-Compliance?** Up to $100,000 CAD per incident plus reputational damage caused by negative publicity.

### PCI DSS

- **What?** [PCI DSS (Payment Card Industry Data Security Standard)](https://www.itgovernance.eu/blog/en/what-are-the-consequences-of-a-pci-dss-violation) is a set of security standards designed to protect payment card data and ensure secure transactions across the payment card industry.
- **Who?** PCI DSS applies to any organization that processes, stores or transmits payment card data, including retailers, service providers and financial institutions.
- **Where?** Global
- **Cost of Non-Compliance?** Organizations found to be in breach of PCI DSS can be fined between $5,000 to $100,000 per month. Other charges may also be brought for repeated non-compliance, for example.

### NIS2 Directive

- **What?** [NIS2](https://digital-strategy.ec.europa.eu/en/policies/nis2-directive) is a legislative act designed to strengthen cyber security requirements for essential services. Its aim is to improve overall online safety across the European Union. The European NIS2 Directive brings new and stricter cybersecurity regulations to many industries. Organizations will have to comply with the new regulations by Autumn 2024 or risk heavy penalties.
- **Who?** There are three criteria that define which organizations must comply with NIS 2 - location, size and industry. More information is available here via. legal services provider Norton Rose Fulbright.
- **Where?** European Union member states.
- **The Cost of Non-Compliance?** Fines are calculated according to business size and overall ‘importance’. Large providers of essential services (utilities, healthcare etc) could be fined up to €10m or 2% of their global revenue – whichever is higher.

## Certifications and Best Practice

As well as legal obligations, your business may need to follow certain industry best practices and frameworks or attain certifications. These may even be a non-negotiable requirement for doing business with some customers.

### ISO Certifications

Achieving ISO standard compliance proves that your business is adhering to internationally recognised standards. For instance, [ISO/IEC 27001](https://www.iso.org/standard/27001) accreditation offers an opportunity to review and upgrade your data backup security practices. 

ISO compliance may be more than your business needs, but that’s no reason not to work towards accreditation. Best practice frameworks offer a roadmap for improving your data backup compliance. 

### Cyber Security Frameworks

Some frameworks businesses can adopt to build their cyber resilience include the following.

- [NIST Cyber Security Framework](https://www.nist.gov/cyberframework) - Overseen by the US Department of Commerce
- [CISA Cyber Essentials](https://www.cisa.gov/resources-tools/resources/cyber-essentials) - Operated by the US Department of Homeland Security
- [Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview) - Backed by the UK National Cyber Security Centre
- [Essential Eight](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight) -Recommended by the Australian Signals Directorate

These frameworks tend to be general in scope. However, adopting them shows your commitment to improving IT security. 

## 7 Ways You Can Demonstrate Data Backup Compliance Now

Achieving certifications, implementing best practice and putting frameworks in place takes time. But there are standards and processes your business can introduce now to demonstrate that you take data backup compliance seriously. 

**1. Regular Data Backup Audits**

Chances are, you have a regular backup schedule in place. But is that data recoverable? Is it held according to best practices and any other compliance requirements? The only way to know is to audit your backups regularly. Additionally, [we recommend verifying them](https://www.linkedin.com/pulse/protecting-your-digital-assets-importance-verifying-backups-novikoff-htibc/) on a regular basis for peace of mind that they’ll prove reliable in a real-life data loss scenario. 

**2. Encryption**

If hackers can’t access your live systems, archives may provide a viable alternative. Encrypting backups ensures hackers cannot use any data they do exfiltrate, adding an extra layer of data security. At Macrium, we offer features such as AES encryption and [Macrium Image Guardian](https://www.macrium.com/mig) to help you protect your backups from malicious actors. 

**3. Implement the 3-2-1 Backup Method**

Local backups are critical for rapid system recovery, but they must be complemented by offsite equivalents. Storing a copy of your data offsite ensures you can always recover, even if your entire data centre is destroyed. For best results, consider implementing the tried-and-tested [3-2-1 backup strategy](https://www.macrium.com/blog/how-to-implement-the-3-2-1-backup-strategy).

**4. Automate your Backup Procedures**

Automation is not only more efficient, it also helps to template common activities. In the case of backup, this allows you to build a fully compliant data backup strategy that delivers exactly the same results on every run. It also avoids many of the errors that can occur when you rely on manual processes. 

**5. Establish Retention Policies**

Establish clear data retention policies outlining how long data should be kept and when to delete older backups. These policies ensure you always have the right data available for recovery. And that you are keeping archives for the correct, legally mandated timeframes.

**6. Regular Training and Awareness Programs**

Employees can be both your biggest strength and your greatest risk. Training people to understand compliance and to operate backups accordingly will help to reduce the risk of breaches. It will also equip them to better protect your backups and live data.

**7. Third-Party Validation**

Engage third-party auditors or compliance experts to validate your data backup procedures, ensuring they meet regulatory requirements. External validation adds credibility to your compliance efforts and provides assurance to stakeholders.

## Helping Your Business Achieve Data Backup Compliance 

Macrium Reflect can help your business establish a robust data backup strategy and work towards achieving data backup compliance - [**try it for free**](https://www.macrium.com/reflectfree#business-backup-and-recovery-with-reflect-workstation) now with our 30-day trial. 

 [Download Your Free Trial](BUTTON_SUCCESS=/reflectfree#business-backup-and-recovery-with-reflect-workstation)



A rubber stamp showing the imprint of a tick, symbolizing data backup compliance or compliance with a law, a regulation or a framework.

7-Ways-Your-Business-Can-Demonstrate-Data-Backup-Compliance.png

Evidencing data backup compliance is vital, especially in heavily regulated industries. We share 7 ways your business can demonstrate backup compliance.

7 Ways Your Business Can Demonstrate Data Backup Compliance

# 5 Ways You Can Protect Your Backups From Ransomware

Cyber criminals no longer need technical expertise to launch ransomware attacks. In fact, they can be executed with a software solution that costs as little as $40 a month. 

Reports show that ransomware cases [increased by 84%](https://www.nccgroup.com/uk/newsroom/annual-ransomware-attacks-increased-by-84-in-2023/) in 2023. And with the global ransomware threat [expected to rise](https://www.ncsc.gov.uk/news/global-ransomware-threat-expected-to-rise-with-ai) as AI becomes more commonplace, the dangers this malware poses to businesses is unlikely to go away any time soon. 

## Why do Cyber Criminals Target Business Backups?

Your business' backups are a valuable target for cyber criminals for a number of reasons. Gaining access to your backups allows them to: 

- **Access extremely valuable data -** Business backups hold valuable data that criminals can use for [exfiltration](https://geekflare.com/data-exfiltration/). For example, sensitive customer credentials, financial details and intellectual property. 

- **Disable operations for leverage -** Many businesses rely heavily on the data stored in their backups for continuity. For example, manufacturing and healthcare businesses may need access to instructions, batch records, certificates and test results to operate on a daily basis. In some cases, losing this data can cause operations to grind to a halt.

- **Cover their tracks -** Ransomware can go undetected for a long time. This increases the potential for devices and files to be infected on a much larger scale. If cyber criminals have infiltrated a network and compromised data, they may attempt to cover their tracks by deleting or encrypting backups. This makes it harder for businesses to recover the original data and trace the source of the attack.

- **Encrypt or delete your data -** A ransomware actor's main upper hand is the threat to delete or encrypt a businesses' data. As backups store a company's most comprehensive and valuable information, access to these are all a criminal needs to achieve their ends.

## How to Protect Your Business Backups from Ransomware

Here are five steps your business can take to mitigate the risk of cyber criminals accessing your backups. 

### 1. Segregate Backups From Your Network

Segmenting backups from the rest of your technology infrastructure can help isolate and protect them. But as long as they’re connected, they’re still vulnerable. 

Keeping backups on a hard drive or a server that’s disconnected from external networks when not in use, also known as [air-gapping](https://csrc.nist.gov/glossary/term/air_gap), is the only foolproof way to keep ransomware actors from accessing them. 

But what makes this approach so secure also makes it extremely inconvenient. Air-gapped backups often require a massive amount of storage space. Additionally, the hardware must be stored somewhere secure. This may not be a problem for a small business that can fit its backup on a single hard drive, but large enterprises may require several servers.

Also, reconnecting hardware to the network regularly can be difficult and time-consuming. The recovery process can take a lot of time as well. For these reasons, this method is best used for only the most critical data.

### 2. Keep Multiple Backups in Multiple Formats

Making several copies of a backup on different types of media makes it more likely that you will have at least one usable copy in case of a ransomware attack. 

One widely recommended approach is called the 3-2-1 strategy. This involves making at least three backups. These are stored in at least two different formats and at least one copy is stored offsite. For example, you could keep one backup copy backed up on an on-site server, another backed up on a server at an offsite location and another copy in the cloud.

### 3. Back up Often Using Different Techniques

Every business should back up data and systems regularly. However, maintaining multiple complete backups may not be feasible for many reasons.

[Incremental and differential](https://blog.macrium.com/incremental-vs-differential-backup-what-are-the-differences-and-how-do-they-compare-3213b093b56a?external_link=true) backups can reduce the burden of storage as well as risk. In an attack, ransomware may be limited to an incremental rather than a full backup. Incremental and differential backups can also be useful during a forensic analysis to determine exactly how and where ransomware compromised them. 

### 4. Limit Access to Backups and Backup Applications

Research shows that [88% of data breaches](https://securitytoday.com/articles/2022/07/30/just-why-are-so-many-cyber-breaches-due-to-human-error.aspx) are caused by human error. Employees can fall for phishing scams, or they might unknowingly download malicious files from a contaminated USB drive or other device. 

While regular security training and a culture that emphasizes security awareness can reduce the risk of these errors, statistics show that may not be sufficient to protect against ransomware. 

A more effective approach is to minimize the number of people on the IT team who have access to backups and any applications used to manage them. Backup tasks and responsibilities can also be divided among different IT team members, either by function or by type of data (such as databases, applications, or documents). This prevents any one person from having total control over backups, limiting the damage if their credentials or access are compromised. 

### 5. Test Backups Regularly

The last thing you want to find in the event of a ransomware attack is that the backups you were counting on have also been encrypted or corrupted. That’s why it’s crucial to test backups regularly and conduct random spot checks to validate their integrity.

If ransomware has compromised a backup, testing increases your chances of detecting it as early as possible, limiting damage and preventing it from spreading to your network. 

## Macrium Image Guardian - Keeping Your Backups Safe from Ransomware

Macrium products, including our backup and recovery solution [Reflect,](https://www.macrium.com/reflectfree#business-backup-and-recovery-with-reflect-workstation) our backup management software [Site Manager](https://www.macrium.com/site-manager) and our imaging and deployment tool [SiteDeploy](https://www.macrium.com/products/business/technicians/sitedeploy-imaging-deployment-software) all include access to Macrium Image Guardian (MIG). MIG is a feature that prevents backup files from being encrypted by ransomware.

[Download a free trial of Macrium Reflect here](https://www.macrium.com/reflectfree) to see how these products and features can help protect your business from ransomware threats. 

[Access Your Free Trial](BUTTON_SUCCESS=/reflectfree)


A photograph of a man's hand stopping dominos falling, representing stopping a ransomware attack in its tracks.

Macrium-Software-Five-Ways-you can-Protect-your-Backups-from Ransomware.png

Don't let your business fall prey to extortion attempts by cyber criminals - here are 5 ways you can protect your backups from ransomware.

5 Ways You Can Protect Your Backups From Ransomware 

<figure><img alt="#TechieTuesday" src="/no-image-to-display.jpg" /></figure>Macrium Reflect provides multiple Backup Plan options to create backup cycles in days, weeks or months that allow you to pick when you want your backup definitions to run and whether they should be Full, Differential or Incremental backups. Scheduled backups can run independently of whether anyone is logged into the computer.Macrium Reflect provides an easy 3 step approach to editing backup plans for a backup definition:<ol><li>First, optionally select a Template from a set that includes implementations of industry best practice like Grandfather, Father, Son (GFS) or Incremental Forever</li><li>Add, remove or change the schedules as needed for full, differential and incremental backups</li><li>Finally, define Retention Rules for each type of backup. Using the Retention Rules, you can retain a specific number of each type of backup or keep them for a number of days or weeks before cleaning up.</li></ol>Options define whether to apply the retention rules to all the backups in the folder, whether to run the purge before backing up, and let you define a minimum amount of disk space to retain in gigabytes (GB) before automatically deleting the oldest backup sets in the destination folder to make space available for new backups.Note: A backup set consists of a full backup and any Incrementals or Differentials with the same image ID. The image ID is the part underlined in the following example backup file name: 69B5FC3F39E0F9F5–00–00.mrimg<figure><img alt="" src="/no-image-to-display.jpg" /></figure>The wizard splits the task of scheduling backups and setting retention rules into 3 steps as follows:<h4>Select a Template for your Backup Plan</h4><ol><li>Click the drop down box and chose an applicable template.A summary is given for each template to help you select the template you require.</li></ol><figure><img alt="" src="/no-image-to-display.jpg" /></figure><h4>Add/Edit Schedules</h4>When you have selected the template you want to use you can view the planned schedule.<figure><img alt="" src="/no-image-to-display.jpg" /></figure>Resolving Scheduling ConflictsIf multiple backup types are scheduled run at the same time on the same day then only one backup will run.. For example, when scheduling a Full backup on the first Monday of each month and scheduling a Differential for every Monday, on the first Monday a Full and Differential are both scheduled to run at the same time. In this scenario only the Full backup will run.<ul><li>Full backups take precedence over Differentials and Incrementals</li><li>Differential Backups take precedence over Incrementals.</li></ul>To add to this schedule:<ol><li>Click Add Schedule and select either Full, Differential or Incremental.</li><li>Set the frequency for the backup schedule.</li><li>Click OK.</li></ol><figure><img alt="" src="/no-image-to-display.jpg" /></figure>To Edit the schedule:<ol><li>Select the schedule you want to edit and click Edit Schedule.</li><li>Change the schedule to meet your needs and click OK.</li></ol><figure><img alt="" src="/no-image-to-display.jpg" /></figure>To delete a schedule:<ol><li>Select the schedule you want to delete and click Delete Schedule.</li><li>A confirmation box appears, click Yes.</li></ol><figure><img alt="" src="/no-image-to-display.jpg" /></figure><h4>Define Retention Rules</h4><figure><img alt="" src="/no-image-to-display.jpg" /></figure>Establish how long each type of backup in the schedule should be kept. It is advisable to keep backups for the recommended period, however you can de-select the backup type if you do not want to retain it.The new Macrium Reflect retention rules provide a powerful and flexible way to manage the lifetime and storage space used by your backups.Choose how backups are matched and retention rules are applied to the target folderRetention rules are applied to the target folder of the backup by selecting one of two options:<figure><img alt="" src="/no-image-to-display.jpg" /></figure>Apply retention rules to matching backup sets in the target folder.Disk Images are purged if they contain exactly the same Partitions as the current Image. Partitions are identified using the unique Disk ID stored in sector 0 of the disk and the Partition sector offset. Note: For GPT disks the unique GPT disk GUID is used instead of the Disk IDFor File and Folder backups retention rules are applied according to the ‘Backup Set Matching’ option select in the ‘Advanced Properties’ for this backup.Apply retention rules to all backup sets in the target folder. All backup sets in the target folder of the same type (Disk Image or File and Folder) are purged according the retention rules.Note: This option uses the same logic as Macrium Reflect v5Select the age or number of backup types that you wish to keep<figure><img alt="" src="/no-image-to-display.jpg" /></figure><h4>Advanced options</h4>If required, set Advanced Options as follows:<ul><li>Compression to reduce the file size. Select level of compression and whether to make an intelligent sector copy, that copies only disk sectors used by the file system or make an exact copy of the partitions, that includes unused sectors. Note: reducing the file size may increase the total backup time.</li><li>File Size to enter a fixed file size for the image, this is useful for manually copying the image file to CD/DVD.</li><li>Password to select whether to password protect the image.</li><li>Auto Verify Image to select to verify image or backup file directly after creation. Note: This can add a significant amount of time to the backup process.</li><li>Comments to set comments for the image or backup.</li><li>Shutdown to set whether the computer should be shutdown after a backup task has completed.</li></ul><figure><img alt="" src="/no-image-to-display.jpg" /></figure>Download a 30-day Trial of Macrium Reflect for <a href="/products/home">Home</a> or <a href="/products/business/standalone/workstation">Business</a> use.

Macrium Reflect provides multiple Backup Plan options to create backup cycles

Techie Tuesday: Creating and Editing a Backup Plan

# Techie Tuesday: Imaging Disks With Bad Sectors

A disk with bad sectors is permanently damaged and, if the bad sectors are in use by the file system, it is very likely that data in the damaged area is unrecoverable. This can signify that your hard drive is coming to the end of its life. 

It is possible, however, to manage the situation and create an image for restoring or mounting and copying files and folders. See this Wikipedia article [http://en.wikipedia.org/wiki/Bad\_sector](http://en.wikipedia.org/wiki/Bad_sector) for more information.

If a bad sector is encountered during image creation then you receive this error in your backup log:

Backup aborted! Unable to read from disk — Error Code 23 — Data error (cyclic redundancy check).  

This is considered a fatal condition because data cannot be read and the image aborts.

#### Run **chkdsk** on the problem drive to reallocate file system clusters to undamaged disk sectors:

1.  Open a command prompt with elevated privileges. See [Running an elevated command prompt](http://knowledgebase.macrium.com/display/KNOW/Running+an+elevated+command+prompt) for help with this.

*   Run **chkdsk c: /r** from a command prompt, replacing c: with the appropriate drive letter.

![techie-tuesday-imaging-disks-with-bad-sectors-2.jpg](https://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/techie_tuesday_imaging_disks_with_bad_sectors_2_29cae62527.jpg)

*   The /r switch is important and causes the entire file system to be checked for bad sectors. This requires a reboot to complete and may take some time.  
  
This operation maps out any bad sectors in use by the file system.

1.  Immediately create an Image of your drive. This ensures all file system clusters are located on good sectors.  

It’s important to realize that you have lost data if clusters are relocated, as the data contained in them is unrecoverable. Consider replacing your disk.

2.  If you receive **_Error Code 23_** in your log after running chkdsk, run chkdsk repeatedly until an image is created without error.
3.  if you are running Windows Vista or later, after restoring an Image to a new disk, run **chkdsk c: /b** to re-evaluate all the bad clusters restored on your drive.  
    If you are running Windows XP, Boot into the Windows PE rescue CD and run **chkdsk c: /b** to re-evaluate all the bad clusters restored on your drive.

#### Set Macrium Reflect to 'Ignore Bad Sectors' When Creating an Image

If running chkdsk is unsuccessful, force Macrium Reflect to continue on Error 23.

1.  Select _Other tasks > Edit defaults > Advanced._
2.  Select **Ignore bad sectors.**
3.  Click **OK**.

![techie-tuesday-imaging-disks-with-bad-sectors-3.jpg](https://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/techie_tuesday_imaging_disks_with_bad_sectors_3_bbe3df52b0.jpg)

If the option ‘Log each bad cluster detail’ selected then each sectors will be reported in the Image log, e.g:

**Read Error: Bad sector found in cluster 2353222  
Read Error: Bad sector found in cluster 2353223**

Otherwise a summary of bad clusters will be reported at the end.

**Bad Sectors: 112 Clusters located in bad sectors. Data may be lost**

## Disk Imaging and Cloning with Macrium Reflect

Perform disk imaging and cloning with our backup and recovery software, Macrium Reflect. 

Try it for free for [**home**](https://www.macrium.com/reflectfree#backup-and-recovery-software-for-home-pcs) or [**work**](https://www.macrium.com/reflectfree#business-backup-and-recovery-with-reflect-workstation) with our [**30-day trial**](https://www.macrium.com/reflectfree). 

[Download Your Free Trial](BUTTON_SUCCESS=/reflectfree)


medium_techie-tuesday-imaging-disks-with-bad-sectors.jpg

small_techie-tuesday-imaging-disks-with-bad-sectors.jpg

thumbnail_techie-tuesday-imaging-disks-with-bad-sectors.jpg

techie-tuesday-imaging-disks-with-bad-sectors.jpg

If your disk has a bad sector, the data on it may be unrecoverable. However, there are some steps you can take to try and salvage the situation - read more in our blog post.

Macrium Software

Latest Blog Post

Latest Video

Need Help?

Products

Standalone

Site Backup

Deployment

Personal

Upgrade Products

Technicians