Backups Are the Ransomware Answer
What removes the attacker's leverage entirely?
The idea
A tested, offline backup makes ransomware an inconvenience rather than a decision about paying.
In the real world
A copy that is not reachable from the machine being encrypted.
Going deeper
A backup only defeats ransomware if the attacker cannot reach it. A nightly copy to a permanently connected network drive is encrypted along with everything else, because it was writable from the compromised machines.
What makes a copy independent of the incident is being offline, immutable, or held in a system with separate credentials. This is the control that still works after the attacker has succeeded, which is a rare property, and it converts an extortion decision into an inconvenience. It also needs testing, since a restore that fails during an incident is functionally no backup at all.
Where it stops applying
Backups do not address data theft, and many attacks now exfiltrate before encrypting. They remove the leverage of encryption, not the leverage of disclosure.
Why it matters
It is the one control that works even after the attacker has succeeded.
Try this today
Check whether one of your backups is reachable from the machine it protects.
Test yourself
A company backs up nightly to a network drive that stays connected. Ransomware encrypts the servers. What happens to the backups?
Show the answer
They are encrypted too, because they were reachable from the compromised machines. A backup only defeats ransomware if it is offline or otherwise not writable from the environment being attacked, which is what makes the copy independent of the incident.
Learn this in the feed Answering from memory, then again days later, is what makes it stick.