How to avoid a wipeout

Issue 1 2023 Infrastructure, Security Services & Risk Management


Byron Horn-Botha.

Wiper malware is an alarming threat to corporate data. Unlike ransomware, which can encrypt and disable your files until you pay a ransom, wiper malware aims to delete your data permanently and cause as much destruction as possible. Once it infects your system, it will make your data completely unrecoverable. This type of malware is hazardous because it offers no possibility of recovery by paying a ransom.

Wiper malware has grown more common in recent years, with several high-profile attacks making headlines. The destructive WannaCry attack in 2017, which affected hundreds of thousands of computers worldwide, is believed to have been a wiper attack. Other notable wiper attacks include Olympic Destroyer in 2018, which targeted the Winter Olympics in South Korea; and ZeroCleare in 2020, which targeted the energy and industrial sectors in the Middle East. Even the infamous Sony Pictures hack was a wiper attack.

Wiper malware is also a weapon of cyber warfare. As the conflict between Russia and Ukraine continues, Ukraine has seen a withering barrage of wiper attacks. Recently, researchers at Fortinet reported that criminals deployed wiper malware against other countries. In the first half of 2022, seven new wiper variants were used in campaigns against private, government, and military organisations. Indeed, there have been wiper malware attacks in twenty-four countries beyond Ukraine, with some of these attacks targeting critical infrastructure using disk-wiping malware.

One of the fundamental challenges in dealing with wiper threats is that they are very often difficult to detect and contain. Unlike other forms of malware, which usually come with signs of their presence, wipers erase all traces of themselves once they have completed their destructive work. It makes it difficult for IT security professionals to respond to these attacks and prevent them from spreading.

Organisations must implement robust, multi-layered security measures, including regular backups of critical data to defend against wiper threats. It is also essential to maintain a strong security posture and be alert to signs of a potential wiper attack. Here are three steps your company can take to minimise your risk of falling victim to these destructive attacks.

1: Backup your data

The importance of backing up your data cannot be overstated when defending against wiper malware. While backups cannot prevent an attack from occurring, they provide a lifeline for restoring compromised data caused by wiper malware, or any other type of attack.

By properly managing your backups, you can ensure you have copies of your data that are separate from your production systems. Should wiper malware, ransomware, or any other malware strike the active IT environment, your business can turn to its backups, stored on an immutable storage solution, for restoration. Not only is restoring from backups more cost-effective and faster than paying a ransom to recover data, but it is likely your only recourse in a wiper attack, because paying a ransom is usually not an option.

2: Follow the 3-2-1-1 rule

A 3-2-1-1 data-protection strategy is a best practice for defending against malware, including wiper attacks. This strategy entails maintaining three copies of your data, on two different media types, with one copy stored off-site. The final ‘1’ in the equation is immutable object storage.

By maintaining multiple copies of your data, you can ensure that you have a backup available in case one copy is lost or corrupted. It is imperative in the event of a wiper attack.

Storing your data on different media types also helps protect against wiper attacks. For example, you might keep one copy of your data on a hard drive, another at a cloud-based storage service, and the third on a removable drive or tape. This way, if one type of media is compromised, you still have access to your data through the other copies.

Keeping at least one copy of your data off-site, either in a physical location or in the cloud, provides an additional layer of protection. If a wiper attack destroys on-site copies of your data, you will still have access to your off-site backup.

The final advantage is immutable object storage. Immutable object storage involves continuously taking snapshots of your data every 90 seconds, ensuring that you can quickly recover it even during a wiper attack. This next-generation data-security tool helps to safeguard your information and protect it from loss or damage.

3: Air gap your networks

Air gapping is an efficient and effective method that protects backup data from wiper attacks. There are two types of air gapping: traditional physical and logical air gapping. Physical air gapping involves disconnecting a digital asset from all other devices and networks, creating a physical separation between a secure network and any other computer or network. You can store backup data on media such as tape or disk and then completely disconnect these media from your production IT environment.

Logical air gapping, on the other hand, relies on network and user-access controls to isolate backup data from the production IT environment. Data is pushed to its intended destination, such as an immutable storage or custom appliance, through a one-way street, and can only be managed or modified through separate authentication channels.

The beauty of air gapping is that it renders your data almost invisible to wiper malware attacks, making it nearly impossible for the bad guys to compromise your backups.

A solid, well-managed data backup and recovery plan is the key to ensuring data safety in the face of today’s growing array of threats.

For more information, contact Arcserve Southern Africa, [email protected], https://arcserve.com




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

The hidden cost of cheap networking gear
Duxbury Networking Infrastructure
When it comes to building a network, price is always a consideration, especially in the current economic climate, but there is a difference between smart spending and short-term savings with long-term losses.

Read more...
Open source code can also be open risk
Information Security Infrastructure
Software development has changed significantly over the years, and today, open-source code increasingly forms the foundation of modern applications, with surveys indicating that 60 – 90% of the average application's code base consists of open-source components.

Read more...
Fastest PCIe Gen 5.0 NVMe SSD
Products & Solutions Infrastructure
Sandisk has unveiled the WD_BLACK SN8100 NVMe SSD with PCIe Gen 5.0 technology, an internal SSD delivering speeds up to 14 900 MB/s and capacities up to 4 TB, with 8 TB solutions available soon.

Read more...
Unified storage solution
Products & Solutions Infrastructure
CASA Software has announced the local availability of Nexsan’s upgraded unified storage solution, Unity NV4000, which is ideal for mixed workloads, from virtualisation and video surveillance to secure backup and recovery.

Read more...
Chubbsafes celebrates 190 years
Gunnebo Safe Storage Africa News & Events Security Services & Risk Management
Chubbsafes marks its 190th anniversary in 2025 and as a highlight of the anniversary celebrations it is launching the Chubbsafes 1835, a limited edition 190th-anniversary collector’s safe.

Read more...
Suprema unveils BioStar Air
Suprema neaMetrics News & Events Access Control & Identity Management Infrastructure
Suprema launches BioStar Air, the first cloud-based access control platform designed to natively support biometric authentication and feature true zero-on-premise architecture. BioStar Air simplifies deployment and scales effortlessly to secure SMBs, multi-branch companies, and mixed-use buildings.

Read more...
New law enforcement request portal
News & Events Security Services & Risk Management
inDrive launches law enforcement request portal in South Africa to support safety investigations. New portal allows authorised South African law enforcement officials to securely request user data related to safety incidents.

Read more...
Continuous AML risk monitoring
Access Control & Identity Management Security Services & Risk Management Financial (Industry)
AU10TIX, launched continuous risk monitoring as part of its advanced anti-money laundering (AML) solution, empowering businesses to detect behavioural anomalies and emerging threats as they arise.

Read more...
Back-up securely and restore in seconds
Betatrac Telematic Solutions Editor's Choice Information Security Infrastructure
Betatrac has a solution that enables companies to back-up up to 8 TB of data onto a device and restore it in 30 seconds in an emergency, called Rapid Access Data Recovery (RADR).

Read more...
Advanced surveillance storage from ASBIS
Infrastructure Surveillance Products & Solutions
From a video storage solutions perspective, SkyHawk drives, designed for DVRs and NVRs, offer high capacity, optimised firmware, and a reliability workload rating of hundreds of terabytes per year.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.