The 3-2-1 backup rule: how to survive ransomware and hardware failure
Most companies have backups — until the day they need to restore. Here is a simple, proven model that keeps your data recoverable.
Read articleA ransomware attack rarely starts with a warning. Usually someone notices that files have strange extensions, a server will not start or a ransom note appears on screen. What the team does in the next hour often decides whether the company loses a day or a month.
The first steps
- Isolate, do not switch off. Disconnect affected computers and servers from the network (cable, Wi-Fi, VPN). Powering off can destroy evidence that helps the investigation.
- Protect the backups. Disconnect backup storage and block access to the backup console until you know the attacker cannot reach it.
- Call your IT and security team and inform management. Agree who makes decisions and who talks to staff, clients and authorities.
- Do not contact the attackers and do not pay before specialists have assessed the situation.
- Write everything down: times, what was seen, which systems are affected, what was done.
Next steps
- Find how the attacker got in — VPN, remote desktop, phishing email — and close that path before restoring.
- Reset passwords, starting with administrator and service accounts.
- Restore systems from clean backups, most critical first.
- Watch for repeat activity for several weeks.
The best time to write an incident plan is before the incident. Print it — during an attack, the file server may be encrypted.
Need help with this? Contact CySec for a free consultation.
Frequently asked questions
Should we pay the ransom?
Paying does not guarantee you get your data back, may fund further attacks and can have legal implications. Decide only after specialists have assessed backups and options.
Should infected computers be switched off?
Prefer disconnecting them from the network. Switching off can destroy evidence in memory; but if encryption is visibly spreading and you cannot isolate the machine, powering it off is better than letting it continue.
Do we need to report a ransomware attack?
Depending on the data involved, contracts and applicable law, you may need to inform authorities, clients or partners. Involve legal counsel early.
How do we prevent it from happening again?
Find and close the entry point, enable MFA, patch internet-facing systems, segment the network and keep at least one immutable or offline backup.