Lessons from a cloud service provider's data deletion incident: Backup responsibility lies beyond the cloud service provider

Recently, an incident involving a globally renowned cloud computing provider mistakenly deleting a fund company’s private cloud account has garnered significant attention. This mistake led to hundreds of thousands of the fund company’s members being unable to access their retirement accounts for seven days, causing considerable anxiety among users.

Although the fund company had deployed redundant services in two different regions to ensure easy recovery in case of service failure or data loss, this incident deleted the company’s cloud subscription, resulting in the loss of backup data in both regions. Fortunately, the fund company could recover data because they had backups stored with another cloud service provider.

The CEO of the well-known cloud computing service provider publicly apologized to the fund company’s members, emphasizing that this was an isolated and unprecedented incident. However, this event serves as a reminder to all businesses that even leading global tech companies can face data loss risks. Similar incidents have occurred with cloud service providers in America, prompting reflection on data security and backup practices.

Defining backup responsibility

In a cloud computing environment, defining backup responsibility is crucial. According to the shared responsibility model, both cloud service providers and users have distinct roles in ensuring security. Cloud service providers typically manage facilities, data centers, network components, and the operating systems that run applications and code. The scope of responsibility for service providers expands progressively from IaaS to PaaS to SaaS, but users are still accountable for the security of their data.

Specifically, cloud service providers are responsible for the security of the physical infrastructure and foundational layers, while users must ensure the protection of their data assets within the cloud. Even in a SaaS model, where the provider assumes a larger share of security responsibility, users remain accountable for their data and access management. To ensure data integrity and security, users must take responsibility for their data backups, proactively backing up data and regularly testing the completeness and recoverability of these backups.

Common misconceptions about cloud backups

• All businesses are hosted in the cloud, and it is the responsibility of cloud service providers to ensure the continuity of operations and the security of data.

  Fact: Cloud service providers and users share the responsibility for ensuring data security, which means that users are also required to take measures to protect the data.

• Cloud service providers employ various technologies including multiple copies, multiple availability zones, and snapshot/replication, to protect data in the cloud. Therefore, the security and reliability of cloud-based data are higher than that of on-premises data centers.

  Fact: While these methods address hardware failures and data center downtime, they cannot address data security problems caused by logical errors, virus attacks, or human error.

• Businesses rely solely on cloud service providers’ backup services and keep only backup copies for recovery.

  Fact: Using backup services from the same cloud platform may result in a single point of failure. Additionally, the backup capabilities of cloud platforms are limited. According to the “3-2-1” backup rule, it is necessary to have 3 copies of data, 2 different backup media, and 1 off-site backup.

Choosing a professional backup service provider

To achieve optimal data protection, businesses should engage professional backup service providers. Aurreum specializes in data protection and offers reliable, diversified cloud disaster recovery solutions. Here’s how we can prevent cloud data loss:

Aurreum adopts a multi-layered backup strategy, including on-premises and cloud backups.

• Cloud-to-on-premises backup: Aurreum provides additional security assurance by backing up data from the cloud to on-premises while utilizing cloud resources.

• Cross-cloud backup: Aurreum can back up data from one cloud platform to other heterogeneous clouds. Businesses can reduce the expenses associated with establishing multiple dedicated disaster recovery centers. At the same time, businesses can enjoy the benefits of vast storage and high-performance elasticity offered by cloud computing services.

• Cloud-to-on-premises takeover: Aurreum backs up data from the cloud to on-premises, which ensures the immediate takeover and business continuity during cloud failures.

• On-premises-to-cloud takeover: Aurreum backs up data from on-premises to the cloud, which ensures the immediate takeover and business continuity during cloud failures.

Aurreum regularly backs up data and tests backup sets to ensure their integrity and recoverability. By validating the backup sets, Aurreum ensures that they are reliable and can be used to restore data effectively.

Aurreum uses automated tools and processes to ensure the reliability and efficiency of backups. By minimizing manual intervention, the potential for errors is reduced, and the consistency of backups is improved.

Aurreum is committed to providing the most reliable and advanced backup solutions to ensure that your data assets are always optimally protected.