Protecting infrastructure.
WHAT TO BACK UP
Domain controller system state File servers and their data Application servers and databases Configuration and documentation
WHAT TO ESTABLISH FOR EACH
How much data you could lose How long you could be without it
WHAT TO KEEP SEPARATE
At least one copy offline or otherwise unreachable from the network.
WHY
Ransomware seeks and destroys backups reachable from the systems it encrypts.
WHAT TO PROTECT
Backup credentials, which should not be domain administrator.
WHY
A compromised domain otherwise means compromised backups.
WHAT TO TEST
Restoring individual files Restoring a whole server Recovering the directory
WHY THAT LAST ONE SPECIFICALLY
Directory recovery is complex, and nobody attempts it until it is required.
WHAT TO MEASURE
How long a full restore actually takes.
WHAT TO DOCUMENT
The recovery procedure, stored outside the environment.
WHY OUTSIDE
Documentation inside a failed environment is unavailable exactly when needed.
WHAT TO REVIEW
That every system is covered.
WHAT TO PRACTISE
The procedure, on a schedule.
