Immutable and isolated backups
Copies of data that no account, not even an administrator, can alter or delete for a set period, or that are physically disconnected, which have become the first underwriting condition against ransomware.
An immutable backup is a copy of data written in such a way that it can no longer be altered or deleted for a defined retention period, even by an account with full rights. An isolated backup is separated from the production network, physically or logically, so that an attacker controlling that network cannot reach it. These two properties respond to a shift in attacks: ransomware operators now look for backups first and destroy them before encrypting, precisely because a victim able to restore does not pay. A conventional backup reachable from the compromised domain therefore no longer protects against the attack that matters. Cyber insurers have made this a knockout question in their applications, adding copy frequency, encryption and, above all, the date of the last full restoration test, because a backup never restored is a hypothesis. The so-called 3-2-1 rule, three copies on two media including one offsite, has been extended with an immutable or offline copy and error-free verification. For the underwriter, it is the variable that most clearly separates business interruption of a few days from one lasting several weeks.
Textbook case: two comparable companies suffer the same ransomware. The first, whose backups were reachable from the compromised domain, sees them wiped and rebuilds its systems in five weeks. The second restores in four days from an immutable copy made the day before: business interruption, the main item of the loss, is about eight times smaller.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.