Key takeaways
- Ransomware rarely arrives through a spectacular exploit. It arrives through phishing, stolen credentials and unpatched remote access.
- Attackers typically move through the network unnoticed for days or weeks — and look for the backups first.
- A backup reachable from the production network is not a backup when it matters. Reachable means encryptable.
- The 3-2-1 rule is the minimum: three copies, two media, one off site — plus at least one copy held offline or immutable.
- Disaster recovery is not the backup. It is the rehearsed route back into operation: sequence, responsibilities, time targets.
- A restore that has never been tested is an assumption, not a plan.
How attackers actually get in
The image of a highly specialised attack on an unknown vulnerability dominates the discussion but describes very few cases. Everyday reality is less spectacular and therefore more dangerous: the ordinary routes work, because they are open everywhere.
A typical case is an email that looks like a payment reminder to the finance team or an application to HR — that is, aimed at the people whose job is to open attachments from strangers. Just as common are credentials from an earlier breach that were reused elsewhere, and remote access whose updates have been outstanding for months.
Attacks do not only come from outside. Credentials are traded, and sometimes they come from careless or departed employees. A security concept that only looks at the perimeter misses exactly that part.
- Phishing aimed at departments whose job requires opening attachments from strangers
- Reused or leaked credentials without a second factor
- Remote access and VPN gateways with open, known vulnerabilities
- Service-provider accounts that were never deactivated after a project ended
- Internal accounts with far more rights than the role actually needs
What happens between break-in and encryption
The moment the ransom note appears on screen is not the beginning of the attack but its end. Days or weeks usually precede it, during which the attackers explore the network, escalate privileges and work out what matters to the business.
In that phase they look specifically for the backups, because a victim with working backups does not pay. If backups sit on the same server, in the same network, or are managed with the same administrator rights as the production systems, they are dealt with in one move.
Double extortion has been added to this: data is exfiltrated before encryption and its publication is threatened. That matters because it changes the calculation — even a perfect backup does not solve the problem of stolen data. It only makes you able to work again.
The measures with the greatest effect
A list of security measures can be extended indefinitely; what matters is where you start. The following have the greatest effect relative to effort and cost — and the first three prevent a large share of the cases that actually occur.
- Multi-factor authentication everywhere access comes from outside — the single most effective measure against stolen passwords
- Rights by role rather than by convenience: no account that is permanently allowed to do everything, not even the managing director's
- Updates with a fixed sequence and a fixed date, starting with everything reachable from the internet
- Network segmentation, so a compromised workstation does not automatically mean access to servers and backups
- Detection and alerting that reports unusual activity before encryption starts
- Regular, short training for the departments that are actually targeted
Why most backups fail when it counts
Almost every company backs up its data. Considerably fewer have backups that survive a targeted attack. The difference comes down to one thing: reachability. Whatever is reachable from the production network is also reachable by someone who has gained administrator rights there — and can therefore be encrypted or deleted.
The familiar 3-2-1 rule is the minimum rather than the goal: three copies of the data, on two different media, one of them off site. Against ransomware a further requirement is added that older concepts lack: at least one copy held offline or technically immutable, plus a check confirming the backup can be restored without errors.
This is exactly where the principle behind our sister brand BackOff starts: backup media are held offline in rotation, so that at any moment at least one state is physically unreachable — to an attacker and to an administrator alike. It is combined with doing away with omnipotent accounts. Anyone not using such a concept should at least be able to answer which copy would survive an attack in which the attacker holds administrator rights.
- Three copies, two different media, one off site
- At least one copy offline or immutable (not overwritable, not deletable)
- Separated permissions: whoever administers production does not control the backup
- Test restores regularly and document the result
- Choose retention periods so that even a late-discovered infection still finds a clean state
Disaster recovery is not the same as a backup
A backup is a copy of data. Disaster recovery is the rehearsed route from that copy back into working operation — and in practice a surprising amount sits in between. After a ransomware incident it is rarely a single file that is gone. Servers, directory services, certificates and interfaces are missing, along with the order in which all of it has to start again.
A workable recovery plan therefore answers questions a backup does not: which systems have to run first so the rest can start at all? How long may each system be down, and how much data loss is tolerable? Who decides, who executes, and how do those people reach each other when the phone system and email are part of the damage?
These time targets have established names: recovery time describes how long a system may be down, and the recovery point how far back the last usable state may lie. Both belong to individual applications — finance rarely has the same requirement as the intranet. And both remain wishful thinking until they have been measured at least once under realistic conditions.
The questions management should be asking
IT security is often treated as a technical topic and then delegated to IT. The decisive choices are commercial, however: how long can this business operate without which system, and what may it cost to shorten that time? No IT department can answer that alone.
Four questions are enough to gauge maturity. If any of them can only be answered with a guess, that is where to start.
- Which backup would survive an attack in which the attacker holds administrator rights?
- When was a full restore last tested — and how long did it take?
- In which order do we bring systems back up, and who decides that?
- How do the critical departments keep working if IT is down for several days?
Frequently asked questions
- No. Antivirus is necessary and catches a share of cases, but no system on the market offers absolute security — attackers regularly find ways past current protections. Every security concept therefore has to assume an attack will succeed and answer the question of what happens then.
- Not automatically. What matters is not the location but reachability and permissions. Cloud storage administered with the same credentials as the production environment can be deleted just like a server in the basement. It becomes safe through immutability, separate accounts and a copy outside the reach of the production network.
- Fully at least once a year, and additionally whenever something material changes: new systems, a server replacement, a migration. What is tested is not the file but the procedure — including how long it takes and who can carry it out without the one colleague who happens to be on holiday.
- The question only makes sense the other way round: what does a day of standstill cost? Once that figure is on the table — lost revenue, staff costs without output, contractual penalties, rebuilding, reputational damage — the effort for offline backups and a rehearsed recovery usually falls into place on its own.
- Yes. A large share of attacks is automated and does not look for particular companies but for reachable weaknesses. Small and mid-sized companies are often more attractive because they run the same internet-facing systems as large ones but less often have detection, segmentation and verified restores.