Ransomware resilience: protecting your backups and the data you forget
Ransomware gangs know a business with a good backup will not pay, so they look for the backups first and delete or encrypt them. Resilience means keeping at least one copy they cannot reach, testing that you can actually restore from it, and backing up the data most businesses forget: cloud mail and files, phones, password vaults, DNS records and the business systems in the cloud. This article explains each, using guidance from the US cybersecurity agency CISA, the UK National Cyber Security Centre (NCSC) and the US standards body NIST.
Why ransomware goes after your backups first
CISA's ransomware guide puts it plainly: many ransomware variants try to find accessible backups and delete or encrypt them, so that the victim cannot recover without paying. The NCSC says ransomware actively targets backups to increase the likelihood of payment.
Backup systems themselves are targets. CISA's catalogue of vulnerabilities known to be exploited in real attacks includes flaws in well-known backup software and network storage boxes, several of them marked as used in ransomware campaigns. A backup server is worth an attacker's effort, so it needs prompt updates and logins of its own like any other system.
The 3-2-1 rule, and the copy they cannot reach
The 3-2-1 rule is the classic starting point: three copies of your data, on two different kinds of storage, with one copy off site. It is usually credited to the photographer Peter Krogh, and the US government's 2012 paper on backup options cites his book for it.
Ransomware adds one condition. At least one copy must be out of an attacker's reach. NIST's 2026 ransomware profile asks for a copy kept offline or otherwise where the attacker or ransomware cannot get to it. CISA's first preparation step is to maintain offline, encrypted backups of critical data.
Offline, append-only and locked copies in practice
"Out of reach" can mean several things:
- A disconnected drive. The NCSC notes that ransomware has encrypted USB and network drives that were left connected. A drive plugged in only while the backup runs, then put away, cannot be encrypted while it is in a drawer.
- Backup access that can add but not delete. Cloud storage cannot be unplugged, so it needs what the NCSC calls digital disconnection: the computer being backed up holds credentials only while the job runs, and those credentials can create backups but not remove old ones. The open-source backup tools BorgBackup and restic both offer an append-only mode on the server for exactly this.
- Locked storage. Some object storage can lock files so that nobody, not even the account owner, can delete or change them until a set date. CISA supports delete protection and object lock, and adds a caution that locked storage must be set up carefully because mistakes are costly.
- Versions kept by time, not count. The NCSC's principles for cloud backups recommend keeping earlier versions for a period of time, so a flood of corrupted new versions cannot push the good ones out.
Protect the backup account with a strong, unique password and two-factor authentication. Whoever can sign in to it can delete it.
If you want your backups encrypted before they leave your computer, free tools such as Cryptomator, Kopia and restic do it.
A backup you have not restored is a hope
CISA, the NCSC and NIST all say the same: test your restores. A backup job can report success for months while copying the wrong folder, or nothing at all.
- Restore a few files regularly, and a whole system now and then, to a separate machine.
- Check the backup is clean before you rely on it. NIST advises verifying a backup's integrity before using it to recover, so you do not restore the infection along with the data.
- Keep the recovery plan on paper. CISA recommends a hard copy of your incident plan and contact list, because email and shared drives may be the first things lost. NIST's guide for service providers suggests a recovery "go bag" with the passwords and keys needed to restore, kept offline.
The data you forget
Most businesses back up the office server and stop there. These are the gaps that show up after an attack:
| Data | Why it gets missed |
|---|---|
| Cloud mail and files | People assume the provider keeps a copy for them. Microsoft's consumer services agreement recommends that you regularly back up your content yourself. Google says its Vault tool for business accounts "isn't designed to be a backup". |
| Phones | Sync is not backup. Apple notes that deleting a photo synced with iCloud Photos deletes it on every device. |
| Laptops | Work saved to the desktop never reaches the shared folder. |
| Password vaults | Lose the vault and you lose the keys to everything else, including the backups. Password managers such as Bitwarden and KeePassXC let you export or copy the vault; include it in your backup. |
| DNS records | Your domain's records, including the SPF, DKIM and DMARC entries for email, are often rebuilt from memory if nobody exported them. |
| The website | Its files and its database. Both are needed. |
| The ERP or accounting system | An Odoo backup needs the database and the attached files. A database alone restores records without their documents. |
| The incident plan and contacts | On paper, as CISA advises. |
What a backup cannot do
A backup restores your data. It does not stop criminals publishing data they copied before encrypting your systems, which some criminals do as well. The NCSC notes its backup principles do not address that. Prevention matters as much as recovery: unique passwords, two-factor authentication, prompt updates and care with email. Our article on infostealer malware explains how criminals most often get in.
How Noiz can help
Backups are built into the Noiz services where they belong:
- Every shared hosting plan includes a weekly backup of the plan, kept off site. Open a ticket if you need a restore.
- Private Email keeps daily backups off the mail server.
- WordPress Care takes a restore point before every change, and Managed Odoo backs up the database and the filestore before every change.
- Nextcloud run by Noiz includes backups of the service. As that page says, they are not a substitute for your own copy of anything you cannot afford to lose.
For your servers and workstations, the managed Backup service is run and watched by Noiz, with capacity, retention, frequency and restore terms agreed with you before you buy, file-level or whole-system backups, encryption at rest and restores handled by Noiz. Order it from the Security store, or get in touch for a quote if your set-up needs more than the standard terms.
Sources
Checked 19 October 2026.
Government and standards guidance
- CISA, #StopRansomware guide
- CISA, Known Exploited Vulnerabilities catalogue
- US-CERT, Data backup options (2012, PDF)
- NCSC, Mitigating malware and ransomware attacks
- NCSC, Offline backups in an online world
- NCSC, Principles for ransomware-resistant cloud backups
- NCSC, Small organisations guide: backing up your data
- NIST IR 8374 Rev. 1, Ransomware risk management (June 2026)
- NIST NCCoE, Protecting data from ransomware: a guide for managed service providers (2020)
Tools and vendor documentation
- BorgBackup, append-only mode
- restic REST server
- AWS, S3 Object Lock
- Peter Krogh, Quick advice on storage and backup
- Microsoft Services Agreement
- Google Vault FAQ
- Apple, What does iCloud back up? and iCloud Photos
- Bitwarden, Export vault data
- KeePassXC user guide
- Odoo, Odoo Online database management
- Cloudflare, Import and export DNS records
Noiz
- Backup service
- Shared hosting
- Private Email, WordPress Care, Managed Odoo, Nextcloud
- Plesk backup overview
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
