Backups against ransomware: what a business needs to check

When ransomware encrypts a business's files, the question that determines the scale of the damage is simple: is there a recent, intact copy that the attack could not reach? Many SMEs believe they have a backup and only discover at the worst possible moment that it was incomplete, out of date or connected to the same network that was compromised. This article brings together what a manager needs to check so that the backup does its job.

Why an ordinary backup does not always withstand ransomware

Modern ransomware does not stop at encrypting the folders of the user who clicked the attachment. It frequently looks for mapped network drives, shared folders, connected external disks and even backup consoles that can be reached with the same credentials. If the backup sits on an external hard drive that is plugged into the server all the time, or in a shared folder that any computer can write to, it is likely to be encrypted along with everything else.

Another point that is often overlooked: synchronisation is not backup. Services that mirror files to the cloud also replicate the encrypted version. Some offer version history and a recycle bin with a retention period, which helps, but this needs to be checked and configured, not assumed.

The 3-2-1 rule as a starting point

A well-established reference for small business backups is the 3-2-1 rule:

• 3 copies of important data: the original plus two more;
• 2 different types of media or storage, for example a local NAS and a cloud service;
• 1 copy off-site, physically separate from the office.

To protect against ransomware, it is worth adding one more requirement: at least one of the copies should be offline or immutable. Offline means disconnected from the network once it has been written, such as a disk that is taken to another location. Immutable means stored in a way that cannot be changed or deleted for a defined period, a feature offered by many cloud services and storage devices. Some references call this variation 3-2-1-1.

What the manager should check

You do not need to be technical to ask the right questions of whoever is responsible for IT or of your supplier. These are the main ones:

Scope

Which data is included in the backup? It is common to find the file server covered, but not the database of the business management system, the email, the device configurations or the files that live only on the director's laptop. Make a list of the data the business cannot operate without, and check it item by item.

Frequency and retention

How often is the backup run, and for how long are old versions kept? If it is daily, the business is accepting the loss of up to one day's work. If retention is only a few days and the attack went unnoticed for a week, every available copy may already be contaminated.

Separation and credentials

Can the backup be reached from ordinary computers on the network? Does the backup system use its own account, with a strong password and, where possible, two-factor authentication? If the same administrator account that manages the network can also delete the backups, an attacker who obtains that account will have access to everything. This safeguard ties in directly with access control for business systems.

Monitoring

Does anyone receive and read the job report? Silent failures are common: a full disk, a password that was changed, an agent that stopped running after an update.

Restore testing: the step almost nobody takes

Testing a restore means recovering data from the backup, in a separate environment, and checking that it is complete and usable. A simple routine for SMEs:

1. Monthly: restore a few files and folders chosen at random and open them to check.
2. Every quarter or six months: restore an entire system, such as the ERP database, and check that it starts up and works.
3. Record the result: the date, what was tested, how long it took and what problems came up.

The time measured in the test is business information. If restoring everything takes three days, senior management needs to know this before an incident, so it can decide whether that timeframe is acceptable or whether to invest in a different solution.

Backup is the last line of defence, not the only one

A good backup greatly reduces the impact of ransomware, but it does not prevent the attack. Nor does it solve data leakage: many groups copy the data before encrypting it and threaten to publish it. Under the UK GDPR, that is a personal data breach that may have to be reported to the ICO (Information Commissioner's Office), even if the business recovers everything. That is why backup works best combined with up-to-date systems, malware protection, access control and a well-configured firewall. And when an incident does happen, having a plan helps you avoid destroying evidence or the backups themselves. The article on the first 30 minutes of an incident covers this.

Backup checklist

• There is a list of critical data and systems, and all of them are backed up.
• The routine follows the 3-2-1 rule, with one copy kept away from the office.
• At least one copy is offline or immutable.
• The backup uses its own protected credentials, separate from everyday accounts.
• Retention covers a long enough period to go back to a version from before the attack.
• Someone checks the job reports regularly.
• Restores are tested periodically and the results are recorded.