CME-1202
Automated Backup with Integrity Verification
Description
Regular automated backups with cryptographic integrity verification and tested restore procedures. Enables point-in-time recovery after ransomware, data corruption, or destructive attacks.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Availability (A) | H → L | Data recoverable from verified backups; availability impact bounded by RPO |
CWE Relationships
Verification
Verify backup schedule is active, recent backups exist, and integrity verification is configured
$ systemctl list-timers --all 2>/dev/null | grep -c -i backup
# Expected: >=1 (backup timer active)
# Expected: >=1 (backup timer active)
Platform: linux
$ find <backup_path> -maxdepth 1 -name '*.tar*' -o -name '*.sql*' -o -name '*.dump' | xargs ls -lt 2>/dev/null | head -1
# Expected: Most recent backup less than 24 hours old
# Expected: Most recent backup less than 24 hours old
Platform: linux
$ grep -rl 'sha256sum\|checksum\|integrity' /etc/cron.d/ /etc/systemd/system/ 2>/dev/null | wc -l
# Expected: >=1 (integrity verification configured in backup jobs)
# Expected: >=1 (integrity verification configured in backup jobs)
Platform: linux
Remediation
linux
Daily systemd backup timer with SHA-256 integrity verification
printf '#!/bin/bash\nset -euo pipefail\nBACKUP_SRC="<backup_source>"\nBACKUP_DEST="<backup_dest>"\nTIMESTAMP=$(date +%%Y%%m%%d-%%H%%M%%S)\nARCHIVE="${BACKUP_DEST}/backup-${TIMESTAMP}.tar.gz"\nmkdir -p "${BACKUP_DEST}"\ntar czf "${ARCHIVE}" -C "$(dirname "${BACKUP_SRC}")" "$(basename "${BACKUP_SRC}")"\nsha256sum "${ARCHIVE}" > "${ARCHIVE}.sha256"\nfind "${BACKUP_DEST}" -name "backup-*.tar.gz" -mtime +30 -delete\nfind "${BACKUP_DEST}" -name "backup-*.tar.gz.sha256" -mtime +30 -delete\n' > /usr/local/bin/cme-1202-backup.sh && chmod 755 /usr/local/bin/cme-1202-backup.sh
printf '[Unit]\nDescription=CME-1202 Automated Backup with Integrity Verification\n\n[Service]\nType=oneshot\nExecStart=/usr/local/bin/cme-1202-backup.sh\n' > /etc/systemd/system/cme-backup.service
printf '[Unit]\nDescription=Daily backup timer for CME-1202\n\n[Timer]\nOnCalendar=*-*-* 02:00:00\nPersistent=true\n\n[Install]\nWantedBy=timers.target\n' > /etc/systemd/system/cme-backup.timer
systemctl daemon-reload && systemctl enable --now cme-backup.timer