# Ransomware Resilience: Building Defences That Actually Work
I have watched organisations discover their backups were compromised at the worst possible moment. The ransomware had already encrypted production systems. The backup copies they expected to restore from contained the same malware.
Ransomware resilience means preparing for successful attacks, not just trying to prevent them.
## Understanding the Modern Threat
Ransomware has evolved beyond simple encryption. Today's attacks combine data theft with encryption, threatening to publish sensitive information.
Attackers spend weeks or months inside networks before triggering payloads. They study the environment. They identify critical systems. They locate and compromise backups.
## Immutable Backup Strategies
If attackers can modify or delete backups, those backups provide no protection.
**Write Once Read Many storage** makes data immutable at the storage layer.
**Retention locks** prevent shortening retention periods.
**Air-gapped backups** physically isolate recovery copies from production networks.
## Segmentation and Containment
**Network segmentation** separates critical systems from general user networks.
**Identity segmentation** ensures administrative credentials for one area do not grant access to others.
**Backup infrastructure segmentation** deserves particular attention. Backup servers should be unreachable from general networks.
## Detection and Response
**Endpoint Detection and Response** tools watch for suspicious behaviour.
**Network monitoring** reveals lateral movement.
**Backup system monitoring** deserves specific attention. Changes to backup configurations should trigger alerts.
## Recovery Capabilities
**Recovery time objectives** define acceptable delays. Recovery capabilities must achieve these objectives.
**Testing** validates recovery capabilities. Restore actual systems, not just individual files.
If your organisation wants to improve ransomware resilience, contact us through our contact page.
## Resilience Is Not One Control
Ransomware programmes succeed when they combine:
- initial access (phishing, exposed services),
- privilege escalation,
- lateral movement,
- data theft,
- and encryption.
You reduce impact by breaking the chain in multiple places.
## The Minimum Viable Resilience Stack
1. **Immutable/offline backups** with regular restore testing. 2. **Network segmentation** so one compromised endpoint cannot reach everything. 3. **EDR with isolation** capability and a rehearsed response playbook. 4. **MFA everywhere**, especially for admin and remote access. 5. **Patch discipline** for internet-facing systems.
## Restore Testing: The Bit Everyone Skips
Backups that cannot be restored under pressure are a false sense of security. Schedule quarterly restore tests for:
- an application server,
- a database,
- and a file share.
Measure RTO/RPO and document exact steps.
## Resilience Is Not One Control
Ransomware programmes succeed when they combine:
- initial access (phishing, exposed services),
- privilege escalation,
- lateral movement,
- data theft,
- and encryption.
You reduce impact by breaking the chain in multiple places.
## The Minimum Viable Resilience Stack
1. **Immutable/offline backups** with regular restore testing. 2. **Network segmentation** so one compromised endpoint cannot reach everything. 3. **EDR with isolation** capability and a rehearsed response playbook. 4. **MFA everywhere**, especially for admin and remote access. 5. **Patch discipline** for internet-facing systems.
## Restore Testing: The Bit Everyone Skips
Backups that cannot be restored under pressure are a false sense of security. Schedule quarterly restore tests for:
- an application server,
- a database,
- and a file share.
Measure RTO/RPO and document exact steps.