The Backup That Was Never Tested
You are a trainee at a 12-person veterinary clinic. The practice manager proudly shows you the backup setup: a nightly job copies the patient database and X-ray images to a USB drive that stays plugged into the reception PC, and a second copy goes to a cloud folder shared with the whole staff team. The job reports 'success' every night. The clinic has never restored from backup. A ransomware email is opened on the reception PC on a Tuesday morning; files begin encrypting. The clinic's insurance requires 24-hour recovery.
1. Assess the backup strategy against the clinic's recovery requirement and identify at least four weaknesses.
Read the worked answer
Weaknesses:
- No tested restore - 'success' only means the copy job ran, not that the data is usable. The clinic has no evidence it can meet 24-hour recovery.
- Drive stays connected - ransomware encrypts attached drives, so the USB copy is likely already compromised.
- Cloud folder shared with all staff - any staff account compromise gives access to delete or encrypt the backup; there is no separation of duties.
- Single location for the USB copy - fire, theft or a spilled drink at reception destroys it.
- No versioning or retention - if the encrypted files sync to the cloud folder, the clean copies may be overwritten.
- No documented recovery time objective test - the 24-hour insurance requirement is untested.
Assessment: the strategy fails the 24-hour requirement because there is no proven restore path and the copies are exposed to the same event as the source.
2. Describe the immediate response to the ransomware and the changes you would recommend to the backup design.
Read the worked answer
Immediate response:
- Isolate - disconnect the reception PC from the network and unplug the USB drive, but do not delete anything.
- Notify - tell the practice manager and, per the incident procedure, the privacy officer, because patient data may be affected.
- Preserve evidence - photograph screens, note the ransom message, and keep logs.
- Do not pay - follow the clinic's policy and report to the relevant authority (e.g. ReportCyber).
- Restore from the last known-good copy once it is verified clean, on isolated hardware.
Recommended design (3-2-1-1-0):
- 3 copies, 2 media types, 1 off-site, 1 offline/immutable, 0 errors verified.
- Immutable cloud storage with versioning and a separate backup account not shared with staff.
- Rotate USB drives and keep one off-site, disconnected except during backup.
- Scheduled test restores (e.g. quarterly) with documented recovery times against the 24-hour target.
- Least-privilege access and MFA on backup accounts; alerting on failed jobs.
Reasoning: the design must survive the same event that hits production, and the only proof of recovery is a tested restore.