Almost every organisation that pays a ransom had a backup system. The problem is rarely that nobody took backups. It is that the backups were reachable from the machine that got encrypted.
Modern ransomware looks for backups first. It enumerates mapped drives, network shares and attached storage, encrypts or deletes what it finds, and only then encrypts the live data. By the time anyone notices, the recovery path has already gone.
The 3-2-1 rule, and the part people skip
The rule is old and still correct. Keep three copies of your data, on two different kinds of media, with one copy off-site.
The off-site copy does the work in a ransomware scenario, and it is the one most often implemented as a network share in another office. That is off-site geographically and online logically, which is the wrong way round. What you need is a copy the production environment cannot authenticate to and cannot delete.
What good looks like
- Off-site copies the source cannot reach. Backups pushed to storage that does not accept delete or overwrite instructions from the environment being protected.
- Encryption in transit and at rest. AES-256 as a baseline, so an off-site copy is not a new exposure of its own.
- Retention longer than attacker dwell time. Attackers are often inside for weeks before triggering. Seven days of history may mean every copy you hold is already compromised. We offer up to 21 days for this reason.
- Application-aware backups. A crash-consistent image of a SQL server may not restore into a working database. Application-aware processing is the difference between having a file and having your system back.
- Granular recovery. Most real incidents are one deleted mailbox or one corrupted file, not the building burning down.
The test that actually tells you something
Checking that last night’s job reported success tells you the job ran. It does not tell you that you can recover.
Pick a real system. Restore it somewhere isolated. Log into it. Open the data. Time the whole thing, from the decision to restore to someone being able to work, and write that number down. That number is your actual recovery time objective, and it is usually a surprise the first time.
We run quarterly drill tests against our own infrastructure for exactly this reason, and we would encourage the same whether or not we hold your backups.
If you would rather not run it yourself
Our Backup as a Service is Veeam-powered, stored at Teraco in South Africa, with up to 21 days of retention and the option of us managing it entirely. There is a calculator on that page so you can size it before speaking to anyone.