A Backup Plan That Survives Fire, Theft, and Ransomware

A backup is only useful when it survives the same incident that destroys or compromises the original data.

Many businesses believe they are protected because files are copied to a USB drive, synchronised to the cloud or stored on another device in the same building. That may help with accidental deletion, but it may offer little protection against a serious incident.

A fire can destroy both the server and the backup drive beside it. A burglar can take the laptops, network storage and portable disks together. Ransomware can encrypt connected backup systems before anyone realises an attack is underway.

A resilient backup plan must assume that the primary systems, local equipment, login accounts and even the building itself could become unavailable at the same time.

Why Ordinary Backups Fail During Major Incidents

Most backup failures are not caused by a lack of technology. They happen because the backup design shares the same weaknesses as the live environment.

Common examples include:

• The backup is stored in the same building as the server.
• A portable backup drive remains permanently connected.
• The same administrator account controls both production systems and backups.
• Cloud files are synchronised but not independently backed up.
• Old versions are kept for only a few days.
• Ransomware can delete or encrypt backup repositories.
• Nobody has tested whether the files can actually be restored.
• The backup application reports success even though important folders were excluded.
• Recovery instructions exist only on the affected server.
• The business has not decided which systems must be restored first.

A successful backup job does not automatically mean the business has a successful recovery plan.

Start With the 3-2-1-1-0 Backup Rule

The traditional 3-2-1 rule recommends:

• Keep at least three copies of important data.
• Store those copies on two different types of storage.
• Keep at least one copy off-site.

A stronger modern version is the 3-2-1-1-0 rule:

• 3 copies of the data
• 2 different storage types
• 1 copy stored off-site
• 1 copy kept offline, air-gapped or immutable
• 0 unverified backup errors

The final two elements are especially important for ransomware protection.

An immutable backup cannot be altered or deleted during its protected retention period. An offline or air-gapped backup is not continuously accessible from the live network. The “zero errors” element means backups are monitored, checked and tested rather than simply assumed to work.

Decide What Must Be Protected

Before choosing backup products, create an inventory of the information and systems the business depends on.

This may include:

• File servers
• Microsoft 365 data
• Email
• SharePoint sites
• OneDrive accounts
• Databases
• Customer records
• Accounting systems
• Virtual machines
• Line-of-business applications
• Website files
• Device configurations
• Network equipment settings
• Cloud services
• Employee laptops
• Security-system configurations
• Password-vault recovery information
• Encryption keys
• Documentation and recovery procedures

Do not assume every system is automatically included.

For example, a backup of a virtual server may protect its operating system and applications, but not data held in a separate cloud platform. Microsoft 365 provides resilience and retention features, but businesses may still need an independent backup to meet their own recovery, retention and compliance requirements.

Identify Your Recovery Priorities

Not all systems need to be restored at the same speed.

Ask two questions for each service.

How much data could we afford to lose?

This is known as the recovery point objective, or RPO.

A business might decide that:

• Financial data can lose no more than 15 minutes of changes.
• General shared files can tolerate up to four hours of data loss.
• Archived documents can tolerate a day.
• A rarely updated system can be backed up weekly.

The required RPO determines how frequently backups or replication must run.

How long can the system remain unavailable?

This is the recovery time objective, or RTO.

A phone system or customer database may need to return within an hour. An archive server may be able to remain offline for a day or two.

Without agreed recovery targets, backup spending becomes guesswork. Some systems may receive more protection than necessary while critical services remain under-protected.

Protecting Backups From Fire

A backup stored beside the original equipment is vulnerable to the same physical disaster.

Fire, smoke, heat, water from sprinklers and emergency access restrictions can affect the entire premises. Even equipment that appears undamaged may be unsafe or inaccessible.

To reduce this risk:

• Keep at least one complete backup in a separate geographic location.
• Use a reputable cloud or remote data-centre backup platform.
• Avoid storing the only backup in another room within the same building.
• Confirm that the remote location is far enough away to avoid the same local incident.
• Keep recovery instructions somewhere accessible outside the premises.
• Record how to contact suppliers, insurers and IT support if the office cannot be entered.
• Ensure key staff can securely access recovery systems from an alternative location.

A fire-resistant safe may protect some media, but it should not be treated as the only off-site strategy. Heat ratings, water exposure and the duration of a fire can all affect whether electronic media survives.

Protecting Backups From Theft

A burglary can remove both live equipment and locally stored backups in minutes.

Portable drives are particularly vulnerable because they are easy to identify and carry away. They may also expose sensitive information if they are not encrypted.

A theft-resistant backup plan should include:

• Encrypted backup data
• Off-site copies
• Strong authentication
• Multifactor authentication
• Separate backup administrator accounts
• Secure storage for removable media
• Restricted physical access
• Device and asset records
• A process for revoking access from stolen equipment
• Recovery procedures that do not depend on a stolen laptop

Encryption is essential, but the recovery keys must be protected. Storing the only decryption key on the same device as the encrypted backup can make recovery impossible.

Businesses should also consider what happens when the stolen device was already signed in to cloud services. Quickly revoking sessions, resetting credentials and reviewing account activity may be as important as replacing the hardware.

Protecting Backups From Ransomware

Ransomware creates a more complicated backup challenge because attackers may deliberately search for backup systems before encrypting live data.

Modern attacks may attempt to:

• Delete restore points
• Disable backup services
• Encrypt connected storage
• Remove cloud backups
• Change retention settings
• Steal backup administrator credentials
• Compromise virtualisation platforms
• Delete snapshots
• Remain hidden until older clean restore points have expired

This is why a permanently connected backup drive is not enough.

Use immutable storage

Immutable backups cannot be modified or deleted until a defined retention period has expired.

This can prevent an attacker who gains normal administrative access from immediately destroying every available restore point.

Immutability should be configured carefully. If retention is too short, the attacker may remain undetected until clean versions have expired. If it is too long, storage requirements may become unnecessarily expensive.

Keep an offline or logically isolated copy

An offline backup may be stored on removable media that is disconnected after the backup completes.

Logical isolation can also be achieved through a separate backup environment with restricted access, independent credentials and no routine trust relationship with the production network.

The aim is to ensure that compromising an ordinary Windows administrator account does not automatically give the attacker control of the backups.

Separate backup credentials

Do not use the same account for everyday administration and backup management.

Backup administrators should have:

• Dedicated accounts
• Multifactor authentication
• Strong, unique passwords
• Restricted sign-in locations where practical
• Minimal permissions
• Additional approval for destructive actions
• Monitored administrative activity

Ideally, production administrators should not be able to delete protected recovery points without additional controls.

Keep multiple generations

A single recent copy may already contain encrypted or corrupted data.

Retention should include multiple points in time, such as:

• Frequent backups for recent recovery
• Daily backups for several weeks
• Weekly backups for several months
• Monthly or annual archives where required

The correct schedule depends on the business, legal obligations, available storage and how long an attacker might remain undetected.

Cloud Synchronisation Is Not the Same as Backup

Services such as OneDrive, SharePoint, Dropbox and Google Drive are valuable collaboration platforms, but synchronisation alone should not be treated as a complete backup plan.

If a file is:

• Deleted
• Overwritten
• Encrypted
• Corrupted
• Changed by a compromised account

the change may synchronise across devices.

Cloud platforms often provide recycling, version history and retention features, but these have limits. They may also be controlled through the same compromised account that caused the incident.

An independent cloud-to-cloud backup can provide:

• Separate retention
• Easier recovery across multiple users
• Protection from accidental deletion
• Recovery after account compromise
• Searchable historical versions
• A backup environment with different administrative controls

The important principle is separation. Your recovery copy should not rely entirely on the same account, platform and permissions as the live data.

Do Not Forget Laptops and Remote Workers

Business data is increasingly spread across laptops, home offices and cloud applications.

A traditional server backup may not protect:

• Files saved to a user’s desktop
• Local downloads
• Unsynchronised project folders
• Application data
• PST email archives
• Locally stored databases
• Data on remote devices that rarely connect to the office network

Where possible, business files should be stored in approved managed locations rather than only on individual devices.

Endpoint backup or managed folder synchronisation can help protect remote workers, but the configuration must be enforced and monitored. Simply telling employees to copy files manually is unreliable.

Protect the Backup Configuration Itself

During a major incident, the business may need more than the files. It may also need the information required to rebuild the environment.

Back up or document:

• Firewall configurations
• Network-switch configurations
• Wireless settings
• Server build information
• Virtual machine settings
• Application licence details
• Vendor contact information
• DNS records
• Domain and certificate information
• Recovery keys
• Backup encryption keys
• Administrative procedures
• Business continuity contacts
• Equipment inventories

Store recovery documentation in a secure location that remains available when the main network is down.

A beautifully documented recovery plan is not helpful if it exists only inside the encrypted file server.

Monitor Every Backup Job

Backup alerts should not disappear into an unattended mailbox.

Monitoring should identify:

• Failed jobs
• Partial backups
• Missed devices
• Low storage capacity
• Unexpected changes in backup volume
• Authentication failures
• Disabled protection
• Expired credentials
• Reduced retention
• Unusual deletion attempts
• Devices that have not checked in

A sudden reduction in the amount of backed-up data can be as concerning as a complete failure. It may indicate that folders have been excluded, a device is offline or files were deleted before the backup ran.

Assign responsibility for reviewing backup status. “Everyone assumed someone else was checking it” is a common cause of preventable data loss.

Test Restores Regularly

The only reliable way to know whether a backup works is to restore from it.

Testing should include more than opening a single document. Depending on the environment, carry out:

• Sample file restores
• Folder restores
• Email and mailbox recovery
• Database recovery
• Virtual machine recovery
• Application-level testing
• Bare-metal server recovery
• Full disaster-recovery exercises
• Recovery into an isolated environment
• Verification that restored systems are free from malware

A restore test should confirm:

• The data is complete.
• The correct versions are available.
• The recovery credentials work.
• Encryption keys are accessible.
• The recovery time meets business expectations.
• Staff understand their roles.
• Applications work after restoration.
• Dependencies have not been overlooked.

Testing also reveals practical problems, such as insufficient internet bandwidth, missing licences or recovery procedures that depend on an unavailable employee.

Keep Backups Clean During a Ransomware Incident

Restoring too quickly can reintroduce the attacker.

Before recovery begins, determine:

• How the attacker gained access
• Which accounts were compromised
• Whether malware remains active
• When suspicious activity started
• Which backup dates are likely to be clean
• Whether security settings were changed
• Whether data was stolen before encryption
• Which systems can safely be reconnected

Restored systems should be patched, secured and monitored before returning to normal use.

Passwords and authentication tokens may also need to be reset. Recovering the files without closing the original access route can allow the attacker to return.

Plan for Recovery Without the Main Building

A resilient plan should assume that the office may be unavailable.

Consider:

• Where staff will work
• How they will access essential systems
• Whether phones can be redirected
• How customers and suppliers will be contacted
• Which replacement equipment is needed
• Whether insurance details are accessible
• How recovery decisions will be authorised
• Who will communicate with employees
• How data-protection obligations will be managed
• Which services must be restored first

Backup is one part of business continuity. It restores data, but it does not automatically provide desks, internet access, telephones, replacement equipment or an incident-management process.

A Practical Backup Design for a Small Business

A resilient small-business setup might include:

1. Primary production data stored on managed servers or approved cloud platforms.
2. Local backup storage for fast recovery from accidental deletion or hardware failure.
3. Encrypted off-site backup stored in a separate cloud or data-centre environment.
4. Immutable recovery points protected from alteration or deletion.
5. An offline or isolated copy for severe ransomware incidents.
6. Independent Microsoft 365 backup for email, OneDrive and SharePoint where required.
7. Endpoint protection for important laptop data that is not stored centrally.
8. Separate backup administration with multifactor authentication.
9. Automated monitoring that alerts the IT team to failures or unusual changes.
10. Regular restore testing with documented results.

The precise technology matters less than whether the design removes common single points of failure.

Questions to Ask Your Backup Provider

Do not accept “yes, it is backed up” as the complete answer.

Ask:

• Exactly which systems and folders are included?
• How frequently does each backup run?
• How long are versions retained?
• Where is the data physically or logically stored?
• Is the off-site copy geographically separate?
• Are backups encrypted in transit and at rest?
• Who has permission to delete recovery points?
• Is immutability enabled?
• Are administrator accounts protected by multifactor authentication?
• Can ransomware reach the backup repository?
• How quickly can a single file be restored?
• How quickly can the entire environment be recovered?
• When was the last successful restore test?
• What happens if the main building is inaccessible?
• Who receives and reviews failure alerts?
• Are cloud services such as Microsoft 365 independently protected?
• How are backup encryption keys stored?
• What support is available during a major incident?

The answers should be documented and reviewed whenever the business introduces new systems.

Warning Signs Your Backup Plan Is Not Strong Enough

Your organisation may be exposed if:

• The only backup is a USB drive.
• The backup drive remains connected all the time.
• Backups are stored in the same building as the original systems.
• Nobody knows when a restore was last tested.
• The same password is used for servers and backup administration.
• Multifactor authentication is not enabled.
• Microsoft 365 is assumed to be fully backed up automatically.
• Backup alerts are not actively monitored.
• Retention is too short to survive a delayed ransomware discovery.
• Recovery instructions exist only on the main server.
• Key laptop data is not stored centrally.
• The business has never measured how long a full recovery would take.
• Former employees or suppliers may still have backup access.
• Backups can be deleted using an ordinary administrator account.

Any one of these weaknesses deserves attention. Several together may mean the business has backups but no dependable recovery capability.

Backups Must Evolve With the Business

Backup plans should be reviewed after:

• Introducing a new cloud application
• Moving premises
• Installing a new server
• Hiring remote workers
• Changing IT providers
• Acquiring another business
• Replacing accounting or customer-management software
• Expanding Microsoft 365 usage
• Changing compliance requirements
• Experiencing a security incident

Data environments change quickly. A backup configuration designed two years ago may no longer protect the systems the business now relies on.

The Final Test: Could You Recover Tomorrow?

Imagine arriving tomorrow to discover that:

• The office has suffered a fire.
• Every laptop has been stolen.
• The servers are unavailable.
• Your Microsoft 365 administrator account has been compromised.
• Connected backups have been encrypted.
• Staff cannot enter the building.

Could the business still access clean data? Would the recovery credentials be available? Would you know which system to restore first? Could staff communicate with customers? Has anyone practised the recovery process?

A robust backup plan should provide credible answers before the emergency happens.

Build a Backup Strategy That Can Survive the Worst

Hamilton Group can review your existing backups, identify gaps, implement off-site and immutable protection, secure Microsoft 365 data and test whether your systems can be recovered within the timescales your business needs.

For professional backup, disaster recovery and business continuity support, call Hamilton Group on 0330 043 0069 or visit hgmssp.com to book a meeting with one of our experts.