A backup you haven’t restored is only a hope
Backups fail quietly. How to keep one ransomware can’t touch, and prove it works.
Everyone has backups. Ask when they last restored one and it gets quiet.
Backups fail without telling you. The job stopped after a password change. The database is saved but not the uploaded files. The server can delete its own backups, so ransomware can too. The keys were only on the server that died.
What I set up:
- 3-2-1: three copies, two kinds of storage, one off-site.
- One copy nobody can delete for 30 days. Most cloud storage calls it object lock or retention. It’s the copy ransomware can’t reach.
- An alert when there’s no report, not only when there’s an error.
- Keys and passwords for the backups stored away from the servers.
Then test:
- Monthly: restore a few files and one database somewhere else and open them.
- Quarterly: rebuild one whole system from written steps. Time it.
If the restore takes a day and the business can only stop for an hour, you just found your real problem. Better now than during an incident.