Backup and Disaster Recovery

How these faults present

• Backups will not restore after an attack: Backups share credentials with production Isolate backups with separate credentials.
• A restore takes days, or has never been tried: A backup that has never been restored Perform and time a restore.
• Deleted files are in every backup: A fixed rotation with no exclusion Retention must allow a date to be excluded.
• Backups sit on the live data storage: No separation between original and copy Keep one copy somewhere separate.

Where this differs by device

• An image rebuilds a whole machine, while file level copies need the operating system reinstalled first.
• Ransomware reaches backups that share credentials, so an admin account should never run the backup job.

Where engagements like this go wrong

• Treating a backup as done because the storage exists.
• Keeping every copy on the same network and credentials.
• Storing the only other copy in the same building.

What changes the cost

• Data volume, which sets storage and the time each run takes.
• Retention, since a year of history costs more than a week.
• How soon a restore must be possible, in hours rather than days.