Most organisations can tell you their backup retention. Far fewer can tell you the smallest version of the company they need running after a ransomware attack, or where it would run. That gap is the resilience problem, not the retention policy.
We can call this the minimum viable company. It is the smallest set of services, people and systems that keep you trading, paying people, meeting your legal obligations and talking to customers while everything else is rebuilt - just enough to stay a business.
#Security buys you time, it does not buy you recovery
Most security spend is still weighted towards keeping attackers out. That is the right thing to do, but it assumes you spot them before they do damage.
That assumption is weaker than it was two years ago. AI is making reconnaissance, phishing and lateral movement faster and cheaper, so the window between first access and real damage keeps shrinking.
If you cannot rely on catching them early, the question that matters is how quickly you get the minimum viable company back. That is an infrastructure question as much as a security one.
#What happens when you cannot get it back
AWS told customers this month that it cannot restore access to data held only in the availability zone it lost in the UAE, after its Middle East sites were damaged in the conflict with Iran. For Bahrain it said the damage crossed multiple availability zones and went beyond what the regional and multi-AZ design is built to withstand.
If you were running in that one region, and your copies were in that one region, this is not a slow recovery - the data is out of reach, and nobody can tell you when it will be available. RPO and RTO stop meaning anything at that point.
That is the question the minimum viable company actually asks. Not how quickly you get everything back, but what the business runs on when getting it back is not an option. Which services do you stand up somewhere else entirely, with what data, and how do you keep trading in the meantime.
It was drones rather than ransomware, but ransomware with immutable backups in the same place as the thing you are recovering leaves you just as stuck.
#The answer is not the same for everyone
A manufacturer can stop for weeks and survive it, painfully. Its minimum viable company is cash, orders and supplier payments, and manual workarounds are a legitimate answer.
Critical national infrastructure cannot stop at all. Power, water, defence and health measure the outage in minutes, so the answer is separation, air gaps and out of band control rather than a faster restore. A lot of the underlying operational technology is old and cannot be patched, which has to be part of the plan.
Both need a minimum viable company. Copying one into the other does not work.
#Cyber recovery is not disaster recovery
Restoring the last known-good snapshot is the right answer after a flood. After a cyber attack the same action can put the attacker straight back into the estate you have just rebuilt.
The attacker was probably in the environment for weeks before anything visible happened, so a snapshot taken before the encryption is not automatically clean.
That changes what you need in place;
- Somewhere isolated to restore into, that the production estate cannot reach
- Immutable backup copies, with credentials that do not live on the estate you are recovering
- A way to validate what came back before it touches production
- Out of band communications, because email and Teams may be part of the outage
#Nothing comes back before the foundation does
Your customer portal is not your minimum viable company if it cannot start without identity, DNS, networking and something to run on. That layer is usually called Tier 0, and it comes back first or nothing does.
On a VCF estate the management domain is Tier 0. If the management plane is untrusted, everything above it is untrusted by association, so the recovery plan has to include a clean way to rebuild it on hardware you still trust.
#Build the ugly version first
SpaceX flew a Raptor engine covered in external plumbing before they built the elegant one. It was a mess, but it worked, and it proved the design. The simplification came afterwards, by removing parts.
Do the same. Pick five to ten services, bring them back on reserved hosts on an isolated network, from immutable backups, and time it. It will involve manual steps and a spreadsheet of IP addresses. That is fine.
What you find is the dependencies nobody listed. The licence server. The DNS zone that only exists in the compromised domain. The backup console that authenticates against the AD you are trying to rebuild. You do not find those on a whiteboard, only by running it.
#Three questions worth asking this week
- Can you name the services that make up your minimum viable company, and has the business agreed to that list?
- If your management plane was untrusted, where would you rebuild it, on what hardware, and on which network?
- When did you last restore those services onto isolated infrastructure, and how long did it take?
If the answer to any of those is “we think so” or “not sure”, you do not have a plan yet, you have an assumption.
First published on LinkedIn.
