Ransomware no longer just encrypts the first computer it reaches. Organised groups break in, spend days or weeks exploring the network, steal data, and look for the backups. Only when they are confident you cannot recover do they encrypt everything and demand payment, often threatening to publish the stolen data too.
Why ordinary backups fail
If your backup server is joined to the same domain, reachable over the same network, and accessed with the same administrator accounts, an attacker who controls the network controls the backups. Deleting or encrypting them is simply one more step.
What resilient backups look like
- Separated: backups live on a different system, ideally with a different provider or location, with separate credentials.
- Immutable: once written, a backup cannot be changed or deleted until its retention period ends, even by an administrator. Object storage with object lock and backup systems with write-once retention provide this.
- Multiple versions: keep enough history to go back before the attacker arrived, not just yesterday's copy.
- Monitored: alert on failed backups and on unusual deletions or changes in backup settings.
- Tested: restore regularly, and measure how long a full recovery really takes.
Beyond backups
Backups let you recover; they do not stop data theft. Combine them with multi-factor authentication, patching, least-privilege access, network segmentation and monitoring that can spot an attacker during those days of exploration.
Make the decision before the crisis
Decide now who leads the response, how systems will be restored and in what order, and how you will communicate. A recovery plan written during an attack is always worse than one rehearsed beforehand.
How IDX helps
IDX Box Storage gives you separate backup space with snapshots, and our Data Backup service keeps encrypted, versioned backups in a separate region. For critical systems, our Disaster Recovery service maintains standby infrastructure with tested failover, and our SOC can watch for the signs of an intruder before the encryption starts.
IDX on digital infrastructure
Back to blog →