According to Kaseya, effective defense against this approach requires backups that are isolated, immutable, and regularly tested. In practice, that means ensuring copies exist that attackers cannot easily reach or alter, and verifying through testing that those copies can actually be restored when needed. A backup that has never been tested offers little assurance once an incident occurs.

Key considerations for organizations reviewing their backup posture:

• Isolate backup copies so they are not accessible from the primary network.
• Make backups immutable, so they cannot be modified or deleted by an attacker.
• Test restoration procedures on a regular basis to confirm they work.
• Assume attackers will specifically look for backup systems during an intrusion.

The broader lesson is that recovery capability is now part of the attack surface. If backup systems are reachable and writable, they are a target.

Source: Unknown

Does your organization currently test backup restoration, or are backups still assumed to work until something goes wrong?