Restoring data can restore malware too
If the backup was taken after the attacker got in, restoring it restores them.
Ransomware crews are frequently present for weeks before anything encrypts, so recent backups may contain their access as faithfully as they contain your data. Recovery therefore needs a view on when the compromise began, and backups old enough to predate it, which is a different question from whether backups exist.
More on Backups and recovery
- Offline copies break attacker reachabilityReach ends at the last plug
- Immutable backups trade flexibility for protectionSet in concrete
- RPO and RTO answer different questionsTwo different clocks
- Backup credentials deserve separate protectionNot on the same switch
- Recovery order follows dependenciesBottom crate first
- Backup retention determines how far back you can restore to escape corruption or compromiseAs far back as the rope goes