Technology
Backup and ransomware recovery for public agencies
What a backup strategy must include to survive ransomware, and how to know it works before it is needed.
Ransomware has hit counties, cities, school districts, and utilities repeatedly. Recovery without paying depends entirely on backups that the attacker could not reach and that the agency knows how to restore.
Requirements for ransomware-resistant backup
Isolation. At least one copy that is offline, immutable, or otherwise unreachable from the production network with production credentials. Attackers routinely delete accessible backups before encrypting.
Coverage. Every system that matters, including configuration for network devices and identity systems, not only file servers and databases.
Retention. Enough history to restore from before the intrusion began, which may be weeks earlier than the encryption event.
Testing. Regular restore tests of real systems, timed, with results recorded. Untested backups are hopes.
Separation of credentials. Backup administration credentials separate from domain administration, with multi-factor authentication.
Recovery planning
Recovery time and recovery point objectives per system, agreed with the departments that depend on them. An order of restoration: identity first, then core infrastructure, then critical applications. Clean-room procedures so restored systems are not re-infected. Manual operating procedures for the period before systems return.
The 3-2-1 rule, updated
Three copies, on two media types, one offsite, plus one immutable or offline. Cloud backup services with immutability features satisfy the last requirement when configured correctly.
Testing cadence
Monthly file-level restores, quarterly full-system restores of a sample, annual full disaster recovery exercise. Report results to leadership.
Cost
Backup is inexpensive relative to a multi-week outage, a ransom, or the loss of records. It is also required by cyber insurers, who will ask for evidence.
Where to start
Verify that current backups are actually isolated. Many agencies discover they are not. Then test a restore. Then fix what the test reveals.