Ransomware Recovery
The specific disaster recovery planning required to restore systems after a ransomware incident, distinct from recovery planning for infrastructure failure alone.
Definition
Ransomware Recovery planning addresses a threat that ordinary disaster recovery planning often doesn't fully account for: a failure caused deliberately, by an attacker who may have had access for weeks before triggering encryption, and who may specifically target backups. It requires immutable, air-gapped backup copies, a clear point of confidence about how far back the compromise reaches, and a tested restoration process, treating 'we have backups' as a starting assumption to verify, not a guarantee to rely on.
In Practice
Restoring from the most recent backup after a ransomware incident can simply restore the attacker's foothold along with the data; recovery planning needs to identify a verified clean restore point, not just the latest one available.