Ransomware Meets the Key Server
A law firm runs 12 LTO-8 drives and keeps 1,500 encrypted LTO-8 tapes offsite. Encryption is drive-based; keys live in a key manager VM on the same VMware cluster as the backup server. The firm also has 200 unencrypted LTO-6 tapes from a legacy system; the only LTO-6 drive was decommissioned last month. Ransomware encrypts production storage, the backup catalog, and the key manager VM. The key manager's only backup is on a tape in the library, and that tape is encrypted. The offsite LTO-8 tapes are physically intact. The firm must restore 40 TB of client matters within 72 hours. The incident team asks whether the offsite tapes are usable, which data can be recovered first, and what must change so a single ransomware event cannot destroy both data and keys.
1. Assess recoverability: which tapes can be restored within 72 hours, and which are effectively locked?
Read the worked answer
The LTO-8 tapes are intact but not usable without keys. Drive-based LTO encryption has no backdoor. The key manager backup on an encrypted tape is circular: to read it you need the key manager. Unless there is an offline escrow, HSM copy, or vendor recovery path, the 1,500 LTO-8 tapes are locked. The 200 LTO-6 tapes are unencrypted, but the only LTO-6 drive is gone; obtain one or a compatible reader. Those may be the only recoverable data in 72 hours, so prioritize them for older matters. Do not promise 40 TB until key recovery is proven. The incident team should state a realistic recovery point and keep the locked tapes preserved.
2. What immediate actions would you take to preserve recovery options?
Read the worked answer
Preserve evidence and options. Isolate the VMware cluster; do not delete or reimage the key manager VM; capture snapshots and logs. Check for offline key backups, escrow, HSM, or a disaster-recovery copy. Contact the key manager vendor for recovery. Do not format or reuse any tape. Obtain an LTO-6 drive and test the legacy tapes read-only. Restore the backup catalog from any surviving copy, but do not let catalog restoration overwrite key records. Communicate a realistic recovery point rather than a 72-hour promise that depends on keys nobody has.
3. Redesign key management and backup architecture to prevent recurrence.
Read the worked answer
Key management must be a separate security domain. Use an HSM or hardened key manager outside the backup cluster, with offline escrow and M-of-N split knowledge. Back up keys to media that does not depend on the key manager, and test restore. Keep an air-gapped or immutable copy of the catalog and keys. Use 3-2-1-1-0: three copies, two media, one offsite, one offline or immutable, zero restore errors. Encrypt key backups with an offline key. Monitor key access. Test a full tape restore quarterly, including a restore with the key manager unavailable.