Ransomware has a new target. Is your backup ready?
-
Ransomware operators are shifting tactics, increasingly focusing on backup infrastructure as a primary target rather than an afterthought. The goal is straightforward: if recovery options are destroyed, victims face far more pressure to pay. This trend means that backups can no longer be treated as a passive safety net tucked away somewhere on the network.
According to Kaseya, effective defense against this approach requires backups that are isolated, immutable, and regularly tested. In practice, that means ensuring copies exist that attackers cannot easily reach or alter, and verifying through testing that those copies can actually be restored when needed. A backup that has never been tested offers little assurance once an incident occurs.
Key considerations for organizations reviewing their backup posture:
- Isolate backup copies so they are not accessible from the primary network.
- Make backups immutable, so they cannot be modified or deleted by an attacker.
- Test restoration procedures on a regular basis to confirm they work.
- Assume attackers will specifically look for backup systems during an intrusion.
The broader lesson is that recovery capability is now part of the attack surface. If backup systems are reachable and writable, they are a target.
Source: Unknown
Does your organization currently test backup restoration, or are backups still assumed to work until something goes wrong?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login