Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

7/19/2017
12:10 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Most Office 365 Admins Rely on Recycle Bin for Data Backup

Nearly 66% of Office 365 administrators use Recycle Bin to back up their data, a practice that could leave data lost and unrecoverable.

There are several reasons why Office 365 administrators should not use Recycle Bin to protect their data, but nearly two-thirds continue to do so. This risky and unreliable practice could lead to major loss and its popularity demands stronger protective strategies.

"The Microsoft Recycle Bin is a nice feature, but its job is to help the organization safeguard against accidental data loss," says Rod Mathews, SVP and general manager of data protection at Barracuda Networks. "It's not meant to be a data recovery solution."

Barracuda conducted a survey of general technologists responsible for data protection and recovery to learn about how they safeguard their information. Some of the results, which highlighted the Recycle Bin practice, were "alarming," he notes.

Recycle Bin isn't equipped with the necessary features to protect data stored in OneDrive, Exchange, Sharepoint, and other business services. The information it does protect isn't safe for very long and becomes non-recoverable if it's deleted or ages past the 30-day time limit.

"You won't be able to recover that data in a realistic way by going to the Recycle Bin and restoring emails," Mathews explains. "You'll want a more thoughtful recovery strategy."

Survey respondents represent companies across sizes and industries. While he acknowledges small businesses might not understand the risk of relying on Recycle Bin for data protection, Mathews adds there may be Fortune 500 companies using this method as well.

The rise in ransomware attacks is demanding security leaders to rethink their data protection strategies. Global incidents like WannaCry highlight the danger of not having plans for data backup and recovery. Data recovery may be the only way to avoid paying ransom, and could save a company if the attackers had no intention of restoring the data, as seen in NotPetya.

In an emergency, having backups isn't enough; being able to get to them is just as important. Seventy percent of respondents said data accessibility was equally as important as data availability.

"Depending on the value of the data, companies will invest in different levels of infrastructure to make sure they can recover that data in an appropriate amount of time," says Mathews.

Accessibility is key because more than half (53.4%) of respondents are responsible for data recovery in multiple locations, meaning their systems have to be accessible from different places, using different methods.

About half of respondents said their backups are cloud-based and 76% replicate their data backups in the cloud. Data indicates that the 77.4% who have a disaster recovery plan are using the cloud for both redundancy and accessibility. Mathews predicts we'll see more discussions around how to protect cloud-based environments as more businesses adopt them.

"You need to protect against user errors and malware in the cloud just as you do that kind of protection locally," he emphasizes, noting the Amazon S3 leaks exemplify this. "Cloud providers have protected against a lot of that, but customers still need to think about it."

Researchers also discovered 81.2% of respondents don't test their data protection strategies more than once per year, and about half that number don't test them at all. Testing is critical to ensure data protection is effective but it's also "a huge thing people overlook," Mathews says.

"If they have an issue, how long does it take to get the business back up and running?" he asks. "If you don't have a program, you're going to find out at the worst possible time."

Testing should happen on a regular basis because files change in value, data moves from place to place, and new applications may not be added to the data protection plan. Companies should do random "spot checks": pick a server and make sure you can restore its information.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
wayno
33%
67%
wayno,
User Rank: Apprentice
7/19/2017 | 4:34:41 PM
Recycle bins, really?
I wouldn't have believed it: using the "round file" as a backup tool.  It sounds like a bad movie script and an even worse real-world practice.  Thanks!
REISEN1955
0%
100%
REISEN1955,
User Rank: Ninja
7/20/2017 | 8:05:45 AM
Re: Recycle bins, really?
Insane practice.  I proudly saved one of my 501C3 accounts from a horrible Cryptolocker attack in January of 2014 - ransomware from executive director's machine to server at 1:45 am.  Everything encrypted.  Because I had a reliable off-site backup system (dedicated computer on my network) for each account, I was able to restore ALL of their data within 3 hours the next day.  Using recycle bin????  Babies.  And fools.
Winema
50%
50%
Winema,
User Rank: Apprentice
8/28/2017 | 3:58:14 AM
Re: Recycle bins, really?
Thank you,was looking for this information
Shantaram
50%
50%
Shantaram,
User Rank: Ninja
7/22/2017 | 5:32:47 AM
Re: 192.168.0.1
Useful and interesting article. Thanks. Just continue composing this kind of articles
dmstork
100%
0%
dmstork,
User Rank: Strategist
7/20/2017 | 8:49:45 AM
Some nuances
While the key takeaway is valid (admins should have a valid plan to restore data with private cloud SaaS/IaaS solutions), there are some nuances to be made:

-SharePoint Online Recycle bin retention is 93 days not 30

-SharePoint Online elements can be restored from a backup controlled by Microsoft, you'd have to contact Microsoft Support. (I do not have any experiences with this however)

-Stricly speaking Exchange Online does not use the Recycle Bin, but has it's own solution (Deleted Item Retention) which has a retention of 14 days per default but can be configured up to 30 days: 
But, that is only true for pure Exchange items; it gets trickier with Office 365 Groups or Microsoft Teams, which also leverage SharePoint Online elements.

-Not enabled per default, but still available for all/most plans and for Exchange and SharePoint: In-Place Hold or Litigation Hold/Preservation policies. Which can help the organizations with the challenges described in the article.

While there are solutions out there that can backup elements from SharePoint/Exchange Online, there are still challenges with restoring (especially with features that use multiple services like Office 365 Groups).

Being an Exchange on-prem/Online specialist (and a Microsoft MVP, Office Servers & Services), I often get asked about backing up Exchange Online. There are 4 copies of the data, spread over two datacenters in different regions and one of those four has a delay (lagged), providing a point in time restore option. Combined with the forementioned Hold features Exchange Online has a more robust infrastructure than most of my on-premises Exchange customers have. And probably more cost effective in almost all cases.

So, most of the critism isn't really valid for Exchange Online admins/users. However, awareness from those responsible should indeed be better as I've had to explain this numerous times.

Another note: I haven't read the original survey from Barracuda so I can't really comment on the content. However, I would like to mention that Barracuda has got an Office 365 backup solution, so it's in their own interest to at least highlight possible challenges with native Office 365 solutions. I'm not saying they are spreading falsehoods, but IMHO it's relevant.
bluvg
100%
0%
bluvg,
User Rank: Apprentice
7/20/2017 | 6:53:30 PM
Self-serving?
While O365 backup is an important discussion to have, this seems perhaps self-serving when Barracuda just released their SharePoint backup solution only a few months ago (Oct 2016). Did it only become important because they started to have an offering for it? Barracuda backs up Exchange online, SharePoint online, and OneDrive for Business. If you take the premise further, what should you do with Teams, Groups, Project Online, Planner, Sway, etc.? Ask Barracuda's competitors? Or perhaps approach backup in O365 differently?

Throwing current strains of ransomware out there seems a bit of a red herring with regard to Exchange Online and SharePoint Online. OneDrive for Business is a potential target, but if your ODfB account does get hit with ransomware, how likely is it that you'll pass the Recycle Bin restore window? And how fast is it to restore from the Recycle Bin vs. restore from an external backup appliance? And how long is your on-prem backup rotation?

It's a great marketing strategy to create the notion that "everyone knows you need an O365 backup solution," then implicitly scold non-compliant admins. The reality is as it always has been: you assess the technology and then assess your risk. You might determine that a traditional (on-prem model) backup solution--such as Barracuda's--would be desirable. Or, you might realize that cloud backup considerations are different, and traditional backup solutions may not be the right fit or perhaps even no longer apply. But we shouldn't let this type of marketing strategy take hold and distract us from proper due diligence.
SandraD242
50%
50%
SandraD242,
User Rank: Apprentice
8/21/2017 | 7:03:36 AM
Thanks for posting this article
Thanks for posting this article. Yes, it is true that most of the admins rely on Recycle bin for data backup. But my clients use SysTools Office 365 Backup to backup Office 365 mailboxes. I would like to share this solution with the users and I hope it helps.
5 Ways to Up Your Threat Management Game
Wayne Reynolds, Advisory CISO, Kudelski Security,  2/26/2020
Exploitation, Phishing Top Worries for Mobile Users
Robert Lemos, Contributing Writer,  2/28/2020
Kr00k Wi-Fi Vulnerability Affected a Billion Devices
Robert Lemos, Contributing Writer,  2/26/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3006
PUBLISHED: 2020-02-28
On the QFX3500 and QFX3600 platforms, the number of bytes collected from the RANDOM_INTERRUPT entropy source when the device boots up is insufficient, possibly leading to weak or duplicate SSH keys or self-signed SSL/TLS certificates. Entropy increases after the system has been up and running for so...
CVE-2015-5361
PUBLISHED: 2020-02-28
Background For regular, unencrypted FTP traffic, the FTP ALG can inspect the unencrypted control channel and open related sessions for the FTP data channel. These related sessions (gates) are specific to source and destination IPs and ports of client and server. The design intent of the ftps-extensi...
CVE-2020-6803
PUBLISHED: 2020-02-28
An open redirect is present on the gateway's login page, which could cause a user to be redirected to a malicious site after logging in.
CVE-2020-6804
PUBLISHED: 2020-02-28
A reflected XSS vulnerability exists within the gateway, allowing an attacker to craft a specialized URL which could steal the user's authentication token. When combined with CVE-2020-6803, an attacker could fully compromise the system.
CVE-2019-4301
PUBLISHED: 2020-02-28
BigFix Self-Service Application (SSA) is vulnerable to arbitrary code execution if Javascript code is included in Running Message or Post Message HTML.