Backups That Survive Ransomware
Having backups is not enough. Modern ransomware hunts for them first. Here is how to keep a copy out of reach.
Ransomware operators know that good backups ruin their business model, so they try to find and delete or encrypt them before revealing themselves. A backup that sits on the same network, with the same credentials, can be lost along with everything else.
The 3-2-1 idea
Keep three copies of important data, on two different types of storage, with one copy stored offsite or offline. It is an old rule that still works.
Make one copy untouchable
- Use immutable or offline backups that cannot be altered once written.
- Protect backup accounts with their own credentials and MFA.
- Restrict who can delete or change backup settings.
Test restores
A backup you have never restored is only a hope. Schedule regular test restores of a few files and, at least yearly, of a whole system, and record how long it takes. That number tells you how long a real recovery would take.
