Ransomware encrypts data and demands a ransom to give it back. The only real insurance is being able to restore everything without paying. That is why a good ransomware backup is the first line of defence for any business, from a professional firm to an SME.
Why a ransomware backup stops the attack
A ransomware attack aims to make data unusable and, more and more often, the backup copies that can be reached from the network too. However, if an isolated and verified copy exists, the company can restore its systems and start again. A ransomware backup does not prevent the attack, but it takes away its power to blackmail.
The 3-2-1 rule for a ransomware backup
Three copies of the data, on two different media, one of them off-site. Today there is one more requirement: at least one immutable copy, or one disconnected from the network, that malware cannot encrypt or delete. Also, it is useful to keep several versions over time, so you can go back to a moment before the infection.
Testing restores
Many companies find out that the backup does not work on the very day they need it. Plan regular tests, document the procedures and measure how long it really takes to get back to work. For official guidance, also see the ENISA publications on business continuity.
How often to make copies
The frequency depends on how much data the company produces each day. For an office with management software and shared documents, a nightly copy may be enough, while databases and online sales systems need more frequent copies. Retention matters too: keeping versions for at least thirty days lets you go back even when an infection stays hidden for weeks before it activates.
A complete plan against ransomware
The backup is the pillar, but it must be combined with updates, multi-factor authentication and a segmented network. Find out about our backup and business continuity service and our layered defences against malware.