Learning Ransomware Response & Recovery

Chapter 2. Your Backup System Is Under Attack

If you learn nothing else while reading this book, please learn this: your backup system is likely in grave danger. It is a prime target in an attack, and if they are successful at attacking it:

• It may be unable to perform its most vital function after an attack.

• It may be the reason that your organization ultimately ends up paying the ransom.

• The backup system may be the attack vector through which the ransomware attack happens in the first place.

Did we get your attention? We hope we did, because the only thing worse than knowing that you’re not able to help during any events that would disable your organization is knowing that your backup system was the ultimate cause. You are patient zero. You are the one that let the bad guys in the backdoor.

Some may think “backup system” refers to on-premises servers running backup software; however, in this context, it refers to any system (in the non-IT sense) that is designed to be able to restore your computers after an attack. This may be an on-premises system, a software as a service (SaaS)–based backup provider, or backup software running in cloud systems that you manage. No matter where it is, threat actors are coming for it.

Why Is the Backup System Under Attack?

If the situation is so dire, then why wasn’t the backup system always the attack target? Backup systems have been a vulnerable part of the data center for a long time, so it’s surprising that it took threat actors ...