Ransomware protection
We design backup and storage so that an attack never means losing data or paying a ransom. Here is how it works technically.
What is ransomware
Ransomware is malicious software that blocks access to your data - most often by encrypting it - and demands a ransom, usually in cryptocurrency, to restore it. Today it is run not by individuals but by organized groups that deliberately target businesses, hospitals and public institutions.
Crypto ransomware
Encrypts files, databases and virtual servers. Without the attacker's key, the data is unreadable.
Locker ransomware
Locks access to a system or device. It may not encrypt data, but it stops work entirely.
Double extortion
Steals data before encrypting it and threatens to publish it. A backup only solves part of the problem.
Ransomware-as-a-Service
Developers rent their tools to “affiliates” who carry out attacks. Almost anyone can now order an attack.
How it gets into a company
Most attacks use nothing exotic. One weakness left open is enough.
Phishing
An email with an infected attachment or a link to a fake login page.
Stolen passwords
Leaked or weak passwords for VPN, remote desktop or email without two-factor authentication.
Unpatched vulnerabilities
Flaws in firewalls, VPN gateways and servers for which a patch already exists.
Exposed remote desktop
RDP or server management reachable from the internet without additional protection.
Suppliers
An attack through an external company's access or compromised third-party software.
Infected devices
A compromised laptop or USB drive connected to the company network.
Well-known attacks
Ransomware is not a theoretical threat. These cases hit entire industries.
WannaCry (2017)
Hit hundreds of thousands of computers in more than 150 countries, including UK hospitals. It spread on its own through an unpatched Windows vulnerability.
NotPetya (2017)
Disguised as ransomware, it destroyed data irreversibly. It caused companies such as Maersk and Merck losses in the hundreds of millions of dollars.
Colonial Pipeline (2021)
An attack through a single leaked VPN password without MFA shut down the largest fuel pipeline in the US for several days.
How an attack unfolds
Modern ransomware doesn't start with encryption. First, the attacker makes sure you have nothing to recover from.
Initial access
Phishing, a vulnerable VPN or a stolen password.
Taking control
The attacker gains administrator rights and maps the network.
Attacking backups
Deletes or encrypts backups and snapshots.
Encryption and extortion
Encrypts servers and threatens to publish stolen data.
Backups are the first target. That's why they must withstand even an attacker with administrator access.
Immutable backups
We store backups and snapshots in WORM mode (Write Once, Read Many). Once written, they cannot be modified or deleted for the configured retention period - not by an administrator, not through the API.
NetApp ONTAP
- SnapLock - Compliance and Enterprise mode
- Tamperproof snapshots
Synology DSM
- Immutable Snapshots (Btrfs)
- WriteOnce (WORM) shared folders
Cloud (S3)
- S3 Object Lock in Compliance mode
- A copy outside your infrastructure
Typical lock period for daily backups. We set it based on how long an attack could stay undetected. Monthly backups are locked for longer.
Attack detection
The sooner an attack is detected, the less data it affects. On NetApp storage we use Autonomous Ransomware Protection (ARP), which automatically creates a protected snapshot and raises an alert when it suspects an attack. Across all solutions, we also monitor backup jobs.
Data entropy
Encrypted files look like random noise. A sharp rise in entropy is a clear signal.
Unusual extensions
Mass renaming of files to unknown extensions.
Activity spike
A sudden surge of writes and deletions outside the normal profile.
Backup anomalies
A sharp increase in changed data or a drop in deduplication.
Isolation and access control
Even if an attacker takes over your network, they must not reach your backups. That's why the backup infrastructure is separated and access to it is strictly protected.
Separate network
Backups live in a dedicated segment (VLAN), outside the Active Directory domain.
Two-factor authentication
Management requires separate admin accounts and MFA.
Second-person approval
Deleting snapshots or changing policies must be confirmed by another administrator (Multi-Admin Verification).
Least privilege
Default accounts are disabled; everyone has only the access they need.
The 3-2-1-1-0 rule
A proven backup standard. Replication to a second site or an EU data center is handled by NetApp SnapMirror or Synology Snapshot Replication and Hyper Backup. Data is encrypted in transit (TLS) and at rest (AES-256), and the keys stay with you.
Fast recovery
Snapshot recovery doesn't copy data - it simply returns the volume to its previous state (NetApp SnapRestore, Btrfs snapshots). We can start virtual servers directly from backup and move them back to production while they run.
Volume recovery from a snapshot, regardless of data volume.
Before recovering, we always identify the last state before the attack began, so the infection doesn't come back with the data.
Testing and the runbook
A backup that has never been restored is not verified. That's why we regularly test recovery in an isolated environment and send you a report. Together with you, we prepare a runbook: who does what, in what order and how long it takes.
What happens during an attack
When an attack hits, nobody improvises. We follow a prepared plan.
Detection
We catch suspicious activity and contact you immediately.
Isolation
We disconnect affected systems so encryption can't spread.
Recovery point
We find the last clean snapshot before the attack began.
Recovery
We restore data and servers according to the runbook.
Analysis
We find out how the attacker got in and close that path.
Why not to pay the ransom
Paying may look like the fastest way out. In practice, it brings more risks than certainty.
No guarantee
The decryption tool may not work at all or only partially, and recovery is often slow.
Stolen data stays stolen
Paying does not guarantee the attacker will delete the data or not sell it on.
Repeat target
A company that paid once often becomes a target again.
Legal risk
Payment may breach sanctions rules if the group is on a sanctions list.
Obligations after an incident
Ransomware is not just a technical problem. It can trigger legal obligations with short deadlines.
Personal data breach
Under the GDPR, a personal data breach must be reported to the supervisory authority within 72 hours of discovery.
Cybersecurity law
Entities covered by NIS2 cybersecurity legislation must report significant incidents to the national authority.
Informing those affected
Where there is a high risk to people, customers or employees must be informed as well.
Documentation
The course of the incident and the measures taken must be documented. A prepared runbook makes this much easier.
What you can do right now
Immutable backups are the last line of defense. These steps reduce the chance an attacker gets in at all.
Two-factor authentication
On VPN, email, remote access and all administrator accounts.
Updates
Regularly patch firewalls, VPNs, servers and backup software.
Train your people
Employees who recognize phishing are the cheapest protection there is.
Endpoint protection
Modern antivirus or EDR that catches suspicious behavior, not just known samples.
Want to know where you stand?
We'll review your current backups and suggest what to improve.
Contact us