Cyber Recovery
Cyber Recovery tests ransomware and destructive-attack response: how you isolate, choose a clean recovery point, recover into a clean environment, and prove the result is malware-free. It is incident response plus recovery engineering, not a simple restore.
Core rules
- Contain first: isolate affected segments, disable compromised accounts, preserve evidence, and keep recovery traffic off infected networks.
- Use immutable offsite copies and anomaly detection to find the last known-good point. The newest backup may already contain attacker persistence.
- Recover to a clean room with separate identity, network, and credentials. Scan and validate before production cutover.
- Sequence by dependency and business tier: identity and core services before dependent applications.
- Document decisions, chain of custody, and communications with security, legal, and business owners.
Worked example
A file server is encrypted and backups show four days of dwell time. The latest snapshot is two days old but contains a malicious scheduled task. Select the snapshot from five days ago, mount it in the clean room, scan with multiple engines, compare file hashes, and verify no unauthorized local administrators. Recover to a new VLAN, reset the machine account and service credentials, then cut over. If validation fails, step back one more restore point.
Traps that cost marks
Restoring over production. Assuming the latest backup is clean. Skipping credential resets. Not preserving logs. Recovering applications before DNS and identity.