When prevention fails, backups are what get you back online. Ransomware has made backup strategy a board-level concern.
3 copies of your data
2 different media types
1 copy offsite (and ideally offline/immutable)
Modern extension — 3-2-1-1-0: add 1 immutable/air-gapped copy and verify 0 errors through regular restore testing.
Sophisticated ransomware deletes or encrypts backups first, then the production data — so the victim has no choice but to pay. Defenses:
An untested backup is not a backup — it's a hope.
Schedule regular restore drills. Measure your RTO (Recovery Time Objective — how fast you recover) and RPO (Recovery Point Objective — how much data you can afford to lose).
DLP tools detect and block sensitive data (credit cards, PII, source code) from leaving the organization via email, uploads, or USB. Combine with data classification so the system knows what's sensitive.
| Stage | Defense |
|---|---|
| Initial access (phishing) | Email filtering, user training, MFA |
| Execution | EDR, application control |
| Spread (lateral movement) | Segmentation, least privilege |
| Backup destruction | Immutable/offline backups |
| Encryption | EDR rollback, rapid isolation |
| Extortion (data leak) | Encryption at rest, DLP, monitoring |
The goal is resilience: assume an attack will eventually succeed, and ensure you can detect, contain, and recover without paying.