Ransomware Hits the Only Backup Copy at an Accounting Firm
Cedar & Vale is a 45-person accounting firm. Its file server holds 12 TB of client tax records. The backup design is a nightly full backup that starts at 22:00 and runs against a NAS in the same server room, finishing around 03:30 inside a 6-hour window. Once a week an external USB drive is connected to the NAS, copied, and taken home by the office manager. The firm's stated targets are an RPO of 4 hours during tax season and an RTO of 8 hours. On a Tuesday morning staff cannot open documents; files have been renamed with a .locked extension, and a ransom note names a payment deadline. The NAS shares are also encrypted, and the encrypted weekly USB drive was plugged in the previous Friday. The office manager asks whether paying is faster than restoring.
1. Identify every way the current design fails to meet the firm's stated RPO and RTO, separate from the ransomware itself.
Read the worked answer
Judge the design against the numbers it committed to, not against 'we have backups'.
RPO failure. A nightly full backup means the newest recoverable copy is up to 24 hours old. The stated RPO is 4 hours in tax season. If the server dies at 16:00, up to 18 hours of returns, time entries, and signed documents are gone. The design cannot meet 4 hours no matter how well the backup runs.
RTO failure. A 12 TB full restore from a NAS over 1 GbE is a lower bound of roughly 26 hours at a perfect 1 Gbps - in practice far slower, because the NAS is also serving reads. The 8-hour RTO is unreachable. Restoring a full backup plus replaying a day of changes would exceed a working day before any verification.
Restore confidence failure. Nothing in the description says a restore was ever tested. An untested backup is a hypothesis.
Isolation failure. The NAS is on the same network as the server and in the same room, so it shares the blast radius. A single credential compromise reaches both.
The ransomware did not break this design; it revealed it. The firm was already outside both targets before Tuesday.
2. Redesign the backup scheme to meet the stated targets, and state the trade-offs you are accepting.
Read the worked answer
Work backward from the targets.
To meet a 4-hour RPO: keep the nightly full (or a weekly full plus daily incrementals) and add incremental backups every 2–4 hours during business hours. That changes the failure window from a day to a morning.
To meet an 8-hour RTO: the restore path must be short. Options: keep a recent full image staged on fast local storage so only the last incrementals need replaying; replicate the primary backup to a second device so restores can read from either; or use a purpose-built backup appliance that can present a recovered image directly. Test a full monthly and time it - if the measured restore exceeds 8 hours, the RTO is fiction and must be renegotiated with the partners in writing.
For isolation (3-2-1): three copies, two media, one offline/off-site and immutable. Snapshots that the server's credentials can delete are not a ransomware control. An object-lock or offline copy the production account cannot touch is.
Trade-offs to state explicitly: cost of a second and off-site copy of 12 TB; backup window contention against tax-season overtime; and the operational cost of quarterly restore drills. Also: the USB-in-a-bag control is only valid if the drive is rotated to an offline set and never left connected long enough to be encrypted.
3. The office manager wants to pay the ransom today. Give your recommendation and the first six actions after isolating the server.
Read the worked answer
Recommend against paying, and say why in operational terms rather than moral ones: there is no guarantee of a working decryptor, payment funds and confirms the operation, decryption of 12 TB is slow and often partial, and the actor already has the credentials - decryption does not remove them. The firm's actual recovery path is the offline copy, and the first job is to establish whether one exists that predates the encryption.
First actions:
- Disconnect the file server from the network and disable its shares; do not power it off - volatile evidence and encryption keys may help.
- Identify the earliest clean copy: check the off-site rotation for a drive from before Friday.
- Reset privileged and service-account credentials from a known-good device, not from the affected network.
- Review authentication logs for the entry point - VPN, RDP, or a phished mailbox - because restoring without closing it means reinfection.
- Notify partners and counsel about client-data exposure; tax records are regulated, and notification clocks start at discovery, not at recovery.
- Rebuild rather than decrypt: restore to clean hardware, verify file counts and spot-check documents before reconnecting clients.
The order matters: containment and credential rotation before restore, and restore before any client communication that promises a date.