Three things that saved my customers
Jan 5th, 2020 by Jesper Kråkhede
Every time I help a customer recover from ransomware I ask myself what actually made the difference. After a few years the answer is surprisingly short. Three things: immutable backups, a bad network and a bad memory.
Immutable backups first. A backup the attacker can reach is not a backup, it is just another target. Modern ransomware groups go for the backup servers before they encrypt anything. So make sure at least one copy can´t be changed or deleted, not even by a domain admin, for a set number of days. Offline tape works. So does storage with a retention lock.
Then the bad network. I can´t count the times a slow, forgotten line to a branch office or a badly configured replication link stopped the ransomware from reaching everything. Nobody planned it, but it worked.
And the bad memory. This is my favourite. More than once the whole recovery has been saved because someone suddenly remembered: ‘Wait, didn´t we build a lab with a copy of AD on that other cloud service two years ago?’ And there it was. Old, forgotten and not connected to anything. A perfectly good domain controller to start from.
Now, I´m not recommending bad networks and bad memory as a strategy. But they tell you what works: copies the attacker can´t reach.
Build that on purpose instead of by accident.