Ein Backup ist kein Backup-Konzept: Wiederherstellung nach Ransomware

Almost every company has backups today. However, when ransomware strikes, it frequently becomes apparent: the data is backed up, but the Recovery is not working — too slow, incomplete, or encrypted along with the rest. The difference lies not in the software, but in the underlying concept.

Why backups fail in emergency situations

• Backup target in the same context: The backup system is connected to the same domain using the same admin accounts. Attackers specifically target and encrypt the backups first.
• Untested recovery: The restore has never been tested. In a real-world scenario, it would take days instead of hours — or fail silently.
• Unclear sequence: No one has defined which systems must be restored first. Recovery is being performed based on intuition.
• Lack of accountability The backup is 'running', but no one is checking the daily success notifications.

The 3-2-1-1-0 rule as a minimum standard

• 3 Copies of your data.
• 2 different media or systems.
• 1 Offsite backup
• 1 Copies must be offline or immutable — they must be protected from being overwritten, even by administrators.
• 0 Untested recoveries: Every restore test must be completed without errors.

Immutability is the critical point.

Modern ransomware specifically deletes or encrypts online backups before attacking production systems. The answer is Immutable Storage (Object Lock): Backup data is read-only for a defined retention period — even with full admin rights. This ensures that a clean state is always maintained for recovery purposes.

Recovery is a process, not a button

• Define sequence: First identities and network, then core systems, then line-of-business applications — not the other way around.
• Define RTO and RPO per system: How long can a system be down, and how much data loss is tolerable? These are business decisions, not IT questions.
• Maintain an offline copy of the emergency manual: Who calls whom, which systems take priority, and where are the access credentials located? Printed out, not on the server that is encrypted.
• Practice at least once a year: A restore under time pressure is the wrong moment for the first attempt.

The NIS2 reference

The German implementation of NIS2 explicitly requires backup management, contingency planning, and the provision of evidence within risk management. Consequently, a documented and tested backup concept is no longer a voluntary exercise for approximately 30,000 companies, but a mandatory requirement—with personal liability for the executive management.

Note: This article is not a substitute for legal advice. It serves as an initial orientation; the binding examination of your situation should be handled by experts.

← all guides