Key takeaways
- Ransomware often targets backups first, so backups need their own protection.
- Keep at least one copy that's immutable, offline, or isolated from your everyday accounts.
- A tested restore plan is what makes paying a ransom unnecessary.
Backups are your best defense against ransomware: if you can restore your data, you don't have to pay to get it back. Attackers know this. Many ransomware attacks now try to find and delete or encrypt backups before encrypting the rest of a network. Here are eight ways to make sure your backups survive an attack.
How ransomware reaches backups
Backups are vulnerable when they can be reached from the same systems or accounts that an attacker compromises. Common weak points include:
- External drives or network shares that stay permanently connected.
- Backup consoles protected only by a password, or by the same admin account used everywhere else.
- Cloud storage that syncs encrypted files and overwrites good copies.
- Short retention periods that expire clean copies before an infection is discovered.
1. Keep an immutable copy
Immutable backups can't be changed or deleted for a set period, even by an administrator. Many cloud backup and storage services offer this through object lock or write-once (WORM) storage. Even if an attacker gets into your backup account, they can't destroy those restore points.
2. Keep an offline or air-gapped copy
An offline copy is physically or logically disconnected from your network, such as a drive that's only connected during backups and then stored safely. Government guidance on ransomware, including from CISA, recommends keeping offline, encrypted backups of critical data.
3. Follow 3-2-1-1-0
The 3-2-1 backup rule gives you multiple copies in multiple places. The 3-2-1-1-0 extension adds one immutable or offline copy and zero errors on restore tests, which is exactly what ransomware resilience requires.
4. Turn on multi-factor authentication everywhere
Require MFA for backup consoles, cloud backup accounts, and any admin access to backup systems. Stolen passwords are one of the most common ways attackers get in.
5. Separate backup credentials
Don't manage backups with the same accounts used for email or everyday work. Use dedicated admin accounts, give them the minimum permissions they need, and keep backup systems off the main domain where practical.
6. Keep versions long enough
Ransomware can sit unnoticed for days or weeks. If your backups only keep a few days of versions, every restore point might already be infected. Choose retention long enough to reach back before an infection is likely to be discovered.
7. Monitor for warning signs
Sudden spikes in changed files, unexpected deletions, or failed backup jobs can be early signs of an attack. Many backup tools can alert you to unusual activity. Make sure someone reads those alerts.
8. Test restores, and plan for a big one
Recovering from ransomware is usually a large restore under pressure. Test restoring individual files regularly, and rehearse restoring a full system. Know how long it takes, in what order you'll restore systems, and how you'll confirm a restore point is clean.
If ransomware hits
- Isolate affected devices from the network to stop the spread.
- Don't wipe or restore immediately. Contact your IT provider or incident response team, and report the attack to the authorities.
- Find a clean restore point from before the infection.
- Rebuild or clean systems first, then restore data, so you don't restore onto a compromised machine.
- Change credentials, especially admin and backup accounts.
Ransomware backup checklist
- At least one immutable or offline backup copy
- MFA on every backup console and account
- Dedicated backup admin credentials
- Retention long enough to restore from before an infection
- Alerts for unusual changes and failed backups
- Regular restore tests, including a full system
- A written incident plan with contacts
For the bigger picture, see our small business backup plan, or compare services with our cloud backup checklist.