You get hit on a Thursday. Friday you restore from Wednesday night’s backup, because it is the freshest copy and you want to lose as little work as possible. By Monday you are encrypted again. Same attacker, same tools, except now they know where everything is.
This is the failure mode almost nobody plans for, and the frustrating part is that the backup worked perfectly. It captured your servers exactly as they were, including the intruder’s foothold sitting quietly on them. Your most recent restore point can be the most dangerous one you own. The only real defense is being able to reach back further than the attacker was patient.
The Newest Backup Is Not Automatically the Best One
Every instinct says restore the most recent copy. Lose the least work, get back fastest. That instinct is correct when a hard drive dies. It is exactly backward when someone broke in.
Think about food poisoning. You do not recover by going back to the same container of leftovers. You go back to the meal before it. Backups work the same way, because they capture state with no opinion about whether that state is good. A backdoor is just a file. A rogue administrator account is just a directory entry. Your backup software copies all of it with the same cheerful efficiency it applies to your invoices.
- Remote access tools. Attackers often install legitimate remote support software, because it looks normal and survives a restore without raising alarms.
- Extra accounts. A new administrator account created three weeks ago comes back with everything else, still valid, still holding the keys.
- Weakened settings. Disabled logging, new antivirus exclusions, relaxed policies. All of it restores faithfully.
- Scheduled tasks. A job set to run at three in the morning does not care that you spent the weekend recovering.
Attackers Wait, and That Changes Your Math
Encryption is not the first thing that happens. It is the last thing. Before the ransom note appears, someone spent time mapping your network, escalating privileges, locating your backups, and deciding what data was worth stealing on the way out.
The Cybersecurity and Infrastructure Security Agency describes this gap directly when explaining its pre-ransomware notification work. CISA says ransomware actors often take some time after gaining initial access to a target before encrypting or stealing information, a window of time that often lasts from hours to days. CISA built a program around that window, reporting that since the start of 2023 it had notified over 60 entities across the energy, healthcare, water and wastewater, education, and other sectors about potential pre-ransomware intrusions, and that many remediated before encryption or exfiltration occurred.
Here is the part that matters for your retention policy. The day you notice is not the day it started. Your usable restore points begin before the intrusion, not before the encryption, and those are two different dates. Work backward further still and you find the beginning: a phishing email somebody clicked, or a password that leaked in a breach at a completely unrelated company months earlier. The pattern shows up in incidents at businesses of every size, not just the ones that make the news.
What a Good Retention Window Looks Like
The goal is not more storage. It is more distinct points in time, spread out, so you have somewhere to land no matter when the trouble actually started. Old-school backup admins called this grandfather, father, son. The idea holds up.
- Daily copies for two weeks or more. This is your everyday tool. Someone deletes a folder, you go back one day. Most restores you will ever perform live here.
- Weekly copies for several months. This is your reach-back layer, the one that saves you when a problem started quietly and nobody noticed for a while.
- Monthly copies for a year. Cheap, rarely touched, occasionally the only thing that answers a legal or accounting question.
- At least one set nobody can delete. In its 2022 publication NIST IR 8374, the National Institute of Standards and Technology recommends storing data in an immutable format so the database does not automatically overwrite older data when new data is made available. Depth without protection just gives an attacker more to erase.
Modern backup systems store changes rather than full copies each time, so a longer window usually costs far less than the calendar suggests. Ask your provider what ninety days of weekly retention adds to your bill. The number is often embarrassingly small next to the risk.
Verifying a Restore Point Before You Trust It
Depth only helps if you can tell which copy is clean. That judgment is part detective work and part discipline, and it is far easier when you did the preparation beforehand.
- Restore into isolation first. No production network, no internet, no joining the domain. Treat the copy as suspect until it proves otherwise.
- Scan with current definitions. Your security tools missed this once already. Today’s signatures may catch what last month’s did not.
- Compare accounts and scheduled tasks to a known-good list. This is the moment your documentation earns its entire cost. Without a baseline, you are guessing about which account is supposed to exist.
- Line the copy up against your logs. Find the earliest sign of the intruder, then pick a restore point comfortably before it. Comfortably means days, not hours.
- Reset credentials regardless. A clean restore point plus reused passwords just resets the clock for the attacker.
One honest caveat. For a serious compromise this is where you bring in incident response professionals, and your insurance carrier often requires it anyway. Restoring is not the same skill as investigating, and choosing a clean restore point is genuinely an investigation.
Why Seven Days of Backups Is a Gamble
CISA advises small businesses to test their backup procedure and ensure they can roll back data at least seven days if needed. Notice the phrase: at least. Seven days is described as a floor, and plenty of businesses treat it as a ceiling because it is whatever the software shipped with.
A seven day window bets everything on noticing within a week. Sometimes you do, because encryption is loud. But plenty of problems announce themselves slowly, or through a phone call from a vendor, a bank, or a customer who noticed something odd. If your window is seven days and you learn on day nine, every copy you own contains the problem. There is no clean point to pick, and no amount of skill fixes that.
Here is the contrarian version. Extending retention is one of the few security improvements with no downside for your users. Nobody has to change a habit. Nobody has to remember a new step. You change a setting, you pay a little more for storage, and your worst case gets meaningfully better. Compare that to any project that requires training forty people.
The Bottom Line
Backups are not one copy. They are a timeline, and the value is in how far it reaches and how many separate points you can choose from. A single recent copy shows what your systems looked like at the moment somebody else was in control of them. That is a snapshot of the problem, not a solution.
Go look at one setting today: your retention period. If the answer is seven days, or if nobody can tell you, you have found the cheapest meaningful improvement available to your business this quarter. It also happens to be one of the first questions a security assessment asks, which is part of why these fundamentals stopped being optional.
If you want a second set of eyes on your retention settings, and on whether your copies would survive an attacker who has been in your network a while, we are happy to look. We will tell you what we would change, what we would leave alone, and which items actually matter. We work with small and mid-sized businesses throughout Denton County. Contact us today.
Sources:
Comments are closed