01
Immutable and offline backups
A copy a compromised administrator account can neither modify nor delete. This is the measure that decides whether you restart or negotiate.
RISK · RANSOMWARE
Ransomware protection
The day everything is encrypted, it is too late to prepare the backups.
What it is
Ransomware encrypts your files and demands payment for the key. For several years now, the groups running these attacks have added a second threat: they exfiltrate your data before encrypting, then threaten to publish it. Paying therefore no longer solves the problem, since the data is already out. The only tenable position is to make the attack unprofitable: fast detection, backups out of reach, and the ability to restart without negotiating.
How the attack generally unfolds
- D-30
Entry
A poorly protected remote access, a reused password or an attachment opened by an employee. Initial access is rarely spectacular.
- D-20
Quiet reconnaissance
The attacker explores the network, identifies the important servers, the backups and the privileged accounts. This phase often lasts weeks without triggering anything.
- D-2
Neutralising defences
Deleting or encrypting reachable backups, disabling protections, escalating privileges. This is the last moment where detection changes everything.
- D-day
Encryption and demand
The trigger usually happens at night or during a long holiday weekend, to maximise the delay before anyone reacts.
The signals that should raise a flag
None of these is proof, but each deserves a look rather than being written off as an oddity.
- Administrator logins at hours when nobody is working
- Bursts of authentication attempts against a remote access
- Backup jobs suddenly failing for no clear reason
- Antivirus disabled on a server with no support request behind it
- Accounts created or privileges raised outside the usual procedure
The layers that genuinely stop an attack
02
Two-factor authentication on all remote access
Most initial intrusions use a valid credential. MFA makes that credential alone insufficient.
03
Detection on abnormal behaviour
Mass file encryption, backup deletion, privilege escalation: these actions are detectable if someone or something is watching.
04
Network segmentation
A compromised workstation must not give access to production servers or backups. Segmentation limits the blast radius.
05
Regularly tested restores
A backup never restored is an assumption, not a protection. Testing reveals the missing files before it matters.
If it happens anyway
The first hours determine the extent of the damage. These steps are decided beforehand, not during.
- 01Isolate affected systems from the network without powering them off: shutting down destroys useful evidence
- 02Do not restore immediately: while the attacker’s access remains open, the restore will simply be re-encrypted
- 03Notify the people named in the procedure: leadership, insurer, legal counsel
- 04Assess whether personal information is involved, which triggers obligations under privacy law
- 05Document everything as you go, for the insurer as much as for the later reconstruction
Five questions to place yourself
If you answer no to any of them, that is where to start.
- Do you have a backup a compromised administrator could not delete?
- Have you fully restored a system from your backups this year?
- Is two-factor authentication active on all your remote access?
- Could you tell, tonight, whether a privileged account was just created?
- Do you know who to call, in what order, on a Saturday morning?
What we put in place
The question is not whether you will be targeted, but whether you will restart.
We start by testing your backups and checking your remote access: those are the two points that decide the outcome.
Test our backups