Ransomware Near Miss and Backup Privilege Gaps
Mercy Ridge Hospital runs NetWorker with a PowerProtect DD6900 and protects 300 TB across 180 virtual machines and 40 physical SQL and file servers. After a phishing incident encrypted three file servers, restores took 26 hours and required an administrator to use a shared domain account because the backup console MFA rollout was deferred. Immutable retention is set to 14 days, but the same account can change retention and delete backup sets. The last full restore test was nine months ago and covered only a single VM. An anomaly alert on backup size for one file server was closed as a false positive two days before the incident. The CISO wants a 90-day plan with measurable outcomes and no assumption of new headcount.
1. Identify the control gaps and explain why the 14-day immutable retention did not provide the expected protection.
Read the worked answer
The gaps are privilege, authentication, isolation, testing, and alert triage. A shared domain account with delete rights breaks least privilege and non-repudiation. Deferred MFA means one credential can compromise the backup console. The same account can change retention or delete backup sets, so immutability is ineffective in practice. There is no isolated recovery environment, so ransomware on the production domain can reach backup infrastructure. Restore testing is stale and narrow, and the anomaly alert was closed without verification.
Immutable retention protects a backup copy only if an attacker cannot delete the copy or shorten its retention. Here the production account can do both before day 14. The 26-hour restore also shows that recovery depended on a human and a shared credential, not that the DD6900 lacked capacity. The correct control is a separate security account with break-glass deletion, retention lock, MFA, and an isolated vault copy that production administrators cannot reach.
2. Build a 90-day remediation plan with automation and measurable outcomes, without adding headcount.
Read the worked answer
Days 1–15: inventory accounts and roles, enable MFA for all backup administrators, remove the shared account, restrict deletion to a break-glass role, and route anomaly alerts to the SIEM with a named on-call owner. Days 16–45: implement immutable retention under a separate security account, add an isolated recovery vault or air-gapped copy for the 40 physical SQL and file servers, and automate daily restore verification of a sample VM plus a weekly SQL restore. Days 46–75: run a ransomware tabletop and a full restore of one file server and one SQL database; measure actual RTO. Days 76–90: remediate gaps, publish runbooks, and train operators.
Automation should cover scheduled restore jobs, policy compliance reports, and alert ticketing. Measurable outcomes: 100% MFA on backup administrators, zero shared accounts, 100% of critical backups immutable for 14 days, restore test pass rate above 95%, RTO under four hours for tier-1 systems, and anomaly alerts acknowledged within 30 minutes. Assign existing staff as control owners rather than hiring.
3. Define the restore-test metrics you would report to the CISO and explain why each matters.
Read the worked answer
Report per-tier RPO and RTO, restore success rate, time to first byte, time to full restore, and verification that the restored data is usable through database consistency checks or file hashes. Test quarterly for tier 1 and monthly for a sample; record whether the restore used only backup credentials rather than a production domain administrator. Track mean time to detect backup anomalies and the percentage of alerts triaged within the target window.
Each metric answers a different question. RTO proves recovery speed; verification proves the data is usable, not merely copied; credential independence proves the recovery path survives domain compromise; alert metrics prove detection works. A restore that completes in 26 hours but is never validated is not a successful test. Report trends, not a single pass or fail, so the CISO can see whether the 90-day plan is reducing risk.