Backup and recovery
Backups attackers can't reach
When ransomware groups break in, one of their first goals is your backups. If they can delete them, you are far more likely to pay.
1 min readExplainer
The short version
Ransomware groups hunt for backups first. Copies that cannot be changed or deleted, even by an administrator, are what make recovery possible.
Why attackers go after backups
Most ransomware attacks start days before the encryption. Attackers use that time to find the backup system, sign in with a stolen administrator password and delete or encrypt the backups. Then they encrypt everything else.
What protects backups
- Immutable storage: backups that cannot be changed or deleted until a set date, even by someone with full administrator rights.
- Separate credentials: the backup system does not use the same accounts as the rest of the network, so one stolen password does not open both.
- A copy somewhere else: in a separate cloud account or offline, out of reach of anything on your network.
- Multi-factor authentication on the backup console.
- Alerts when backups are deleted or retention settings change.
Questions to ask
- If an attacker had your administrator password, could they delete every backup?
- Is at least one copy unchangeable for a period of time?
- Would you know if backups started being deleted?
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.