A company synchronises the data of its mobile employees with the central file server every evening. During a synchronisation failure, over 14,000 files are overwritten with empty placeholders overnight. The next morning the IT department notices the error — but the last verified backup is three weeks old. The daily backup in between had silently stopped working since an update. No one had been checking the backup logs.
Data loss ranks among the elementary threats with the broadest range of causes. The BSI lists it as G 0.45. Whether hardware defect, operator error, malware or theft — the outcome is the same: a dataset needed for the business is wholly or partly unavailable.
What’s behind it?
Data loss means an event in which a dataset can no longer be used as required. The causes fall into four categories:
Causes of loss
Hard drives, SSDs and other storage media have a limited service life. Without suitable redundancy measures (RAID, replication) a single defect is enough to destroy critical datasets. Power outages during write operations, faulty firmware updates and defective controllers can also cause data loss.
Accidental deletion is the most common form of data loss. A wrong command, an unintended format or a faulty script run can destroy in seconds datasets that took years to build. Particularly risky: synchronisation processes between mobile and stationary systems in which older data overwrites newer data.
Ransomware deliberately encrypts datasets and renders them unusable without the decryption key. Wiper malware deletes data irretrievably. Some malware activates the delete function only after a delay (e.g. on a specific date), so that the moment of infection and the moment of data loss lie far apart.
Mobile endpoints (laptops, tablets, smartphones) are lost, stolen or physically damaged. The data stored on them is often not up to date when the device was offline between synchronisations.
Practical examples
Ransomware with delayed activation. A company is infected with ransomware that initially lies dormant and writes itself into all backup drives in the background. Only after six weeks does the encryption activate. All backups from the last six weeks already contain the malware — a clean recovery is only possible using the oldest offline backup, which represents a significant data loss.
Synchronisation error on mobile devices. A sales representative works offline with his tablet on a customer presentation for three days. On returning to the office, automatic synchronisation overwrites his local changes with the older server version — three days of work are gone. The synchronisation solution had no conflict detection.
Forgotten password for cloud storage. A sole proprietor stores all business documents in a cloud service. After a device change he has neither the password nor the second factor at hand. Password recovery fails because the linked email address has since been deactivated. All documents are permanently inaccessible.
Relevant controls
The following ISO 27001 controls mitigate this threat. (You’ll find the complete list of 42 mapped controls below in the section “ISO 27001 Controls Covering This Threat”.)
Prevention:
- A.8.13 — Information backup: Regular, tested backups following a defined backup concept.
- A.8.10 — Information deletion: Controlled deletion processes prevent accidental deletion of active datasets.
- A.8.14 — Redundancy of information processing facilities: Redundant systems bridge the failure of individual components.
- A.7.14 — Secure disposal or re-use of equipment: Controlled processes prevent needed data from being lost during disposal.
- A.8.7 — Protection against malware: Malware protection blocks data-destroying malicious programs.
Detection:
- A.8.15 — Logging: Logging of deletion and modification events enables traceability of lost data.
- A.8.9 — Configuration management: Documented configurations make faulty changes traceable.
Response:
- A.5.29 — Information security during disruption: Business continuity plans define RPO and RTO for different datasets.
- A.5.26 — Response to information security incidents: Immediate measures on detected data loss (isolation, forensics, recovery).
- A.5.27 — Learning from information security incidents: Lessons-learned process after every data-loss incident.
BSI IT-Grundschutz
The BSI IT-Grundschutz catalogue links G 0.45 with the following modules:
- CON.3 (Data backup concept) — the central module: backup strategy, media rotation, recovery tests.
- SYS.1.1 (General server) — hardening and redundancy of server systems.
- SYS.3.1 (Laptops) — protection and encryption of mobile endpoints.
- OPS.1.2.2 (Archiving) — long-term retention and integrity protection of archived data.
Sources
- BSI: The State of IT Security in Germany — annual report with current incident statistics
- BSI IT-Grundschutz: Elementary Threats, G 0.45 — original description of the elementary threat
- ISO/IEC 27002:2022 Section 8.13 — implementation guidance on information backup