Ransomware: A Recovery Plan That Actually Works

Ransomware is the single greatest threat to business continuity for modern companies. The question is not just how to protect yourself, but how to restore operations within a few hours when protection proves incomplete. This article is a practical recovery plan.

TL;DR — Key Takeaways

• Immutable backups are the only reliable defense against ransomware encrypting your backup data.
• Your plan must be printed out; you often will not have access to systems during an incident.
• The first step is isolation, not power-off; forensic evidence is critical.
• No software license can replace a regular restore test.

How an Attack Unfolds

A typical attack begins with gained access (phishing, stolen credentials, exposed RDP), followed by a quiet period of several days or weeks where the attacker expands access, finds backups, and exfiltrates data. Only then does encryption occur; by that time, most of the damage is already done.

This is why detection during the quiet period is most valuable: EDR, monitoring for unusual logins, and alarms for backup deletion often stop an attack before encryption even starts.

Why Backup Alone Is Not Enough

Attackers today specifically target backups because they know they are an obstacle to extortion.

• Backups on a shared folder with domain access will be encrypted along with everything else.
• Without a restore test, you do not know how long recovery takes, which is critical for the decision to pay or not.
• Leaked data means a mandatory GDPR incident report regardless of successful restoration.
• Without written priorities, the team will restore the wrong systems first.

How to Proceed — Recommended Process

1. Isolate affected systems from the network, but do not shut them down immediately.
2. Activate the crisis team and notify management, legal, and if necessary, your insurance provider.
3. Assess the scope: which systems, what data, and whether exfiltration occurred.
4. Verify backup integrity in a separate environment.
5. Restore by priority: identity, email, ERP, file services.
6. After restoration, change all passwords and keys and conduct a root-cause analysis.

Recovery Priorities

Most Common Mistakes

The most common mistake is immediately shutting down servers. Doing so destroys data in the memory (RAM), which is often crucial for identifying the entry point and preventing a recurrence.

The second mistake is restoring to the same environment without addressing the cause. If the attacker still has valid credentials, the attack will repeat within days.

How VitalIT Helps

At VitalIT, we implement 3-2-1 backup strategies with immutable copies, deploy EDR, and prepare written recovery plans with testing. View Cybersecurity and IT Infrastructure.

See also 3-2-1 Backup: How to Properly Protect Business Data and SIEM and Centralized Security Monitoring.

Frequently Asked Questions (FAQ)

Should we pay the ransom?

Generally, no. Payment does not guarantee recovery, it funds further attacks, and it does not remove the legal obligation to report the incident.

How often should we test recovery?

At least quarterly for critical systems and once a year as a comprehensive exercise.

What are immutable backups?

Copies that cannot be changed or deleted for a set period, even with administrator privileges.

Do we need to report the incident?

If personal data is involved, there is a 72-hour deadline under GDPR; additional deadlines apply for entities under NIS2.

How long does a typical recovery take?

Anywhere from one day to two weeks; the difference is almost always in readiness, not technology.