Ransomware Resilience, Backup and Cyber Recovery

We first measure how the current backup and recovery design would hold up against an attack.

• Review of the backup architecture and retention chain
• Identification of points where backups could be encrypted or deleted
• Recoverability of the identity infrastructure (Active Directory)
• RTO / RPO targets for critical systems agreed with business units
• A map of dependencies that break in a ransomware scenario
• Gap report and a prioritised improvement plan

The 3-2-1-1-0 rule is applied: three copies, two media types, one off-site, one immutable or offline, zero verification errors.

• Immutable repository and object-lock configuration
• Offline or logically air-gapped copies
• A separate identity plane and MFA for the backup console
• Segregation of backup traffic on the network
• Approval and delay on deletion and retention changes
• Automatic verification and alerts for corrupt backups

Even if encrypted files return, service does not resume unless Active Directory does; directory recovery is treated as its own workstream.

• Active Directory forest recovery plan
• Documented recovery order and dependencies
• Clean-room recovery environment design
• Reset of privileged accounts after recovery
• Recovery of the certificate and key infrastructure (PKI)

You only know a backup works when a restore has been attempted. Drill results are compared against written targets.

• A schedule of periodic restore drills
• End-to-end scenario exercises against the clock
• Comparison of measured time with the RTO target
• Drill report and improvement actions
• An evidence file that can be presented at audit

There is no time to decide during an incident; what will be done is written in advance and rehearsed.

• First response, containment and isolation steps
• Evidence preservation and the order of forensic imaging
• A no-ransom principle and legal assessment
• Regulatory notification and customer communication
• Clean rebuild and staged return to service
• Post-incident root cause analysis and closure report