Why replication can't fix the ransomware problem

"Ransomware doesn't knock on the front door. It sneaks in quietly, and by the time you notice, the damage is already done. Backups, replication, and cloud storage help recover from ransomware, but when it strikes, these products may not be enough. You copy your data and ensure copies are recoverable when needed. Replication is often viewed as the gold standard of protection. It is fast, efficient, and seems like an easy answer. Two common types of replication are in use today."

"The first is physical to physical. This is when data is copied from one physical device to another, usually at a remote location. The second is physical to virtual. This is when data is copied from a local physical device to a virtual device in the cloud, commonly managed by a backup vendor. Both replication types can be useful and offer advantages, including uninterrupted service, reduced potential data loss, and data redundancy. But replication has limitations."

"When ransomware hits a server, the infection can spread fast. If replication is active, then corrupted or encrypted data may be copied to the secondary device. Both the original and secondary devices now contain bad data. Instead of serving as a safety net, replication can become a trap locking both environments into a compromised state. Replication can also be complex to set up and maintain, requiring skilled staff. Not every organization has the time, budget, or expertise to set up and maintain a replicated environment."

Ransomware often infiltrates systems quietly and can inflict damage before detection. Backups, replication, and cloud storage aid recovery, but each has limits when ransomware strikes. Two replication types exist: physical-to-physical and physical-to-virtual, each offering uptime, reduced data loss, and redundancy. Active replication can copy corrupted or encrypted data to secondary systems, potentially locking both primary and secondary into a compromised state. Replication setups can be complex, costly, and require skilled staff, and failover still requires rebuilding original systems. Replication remains useful but must be complemented by isolated, immutable backups and validated recovery processes.

Read at Fast Company