Ransomware resilience

How to use

Quarterly, and adversarially. Every item starts from one position: someone is inside the estate holding valid production credentials, has held them for an unknown number of days, and is enumerating what they can destroy. The question is not whether backups exist, but whether anything that credential reaches is the only copy — and how far back the copies it cannot reach go.

Answer each item from a check performed during the review: a document describing a retention policy is not evidence the retention exists. Several items therefore read attempt the destructive operation and record the refusal. Perform those attempts against objects prefixed rbdr- so cleanup is scoped.

Where the numbers come from

The refusal comes from an attempted deletion, not a policy. Run it with the credential a production host holds, against a version under the same retention as the real recovery points, and record the exit code.

$ mc rm --versions --version-id 133fd99f-1f98-41c0-9d08-95e6e2944157 prod/rbdr-immutable/backup-0900.tar

  mc: <ERROR> Failed to remove `prod/rbdr-immutable/backup-0900.tar`. Object, 'backup-0900.tar (Version ID=133fd99f-1f98-41c0-9d08-95e6e2944157)' is WORM protected and cannot be overwritten
>>> exit code: 1

--- can the production identity force it? ---
$ mc rm --bypass --version-id ... prod/rbdr-immutable/backup-0900.tar
mc: <ERROR> Failed to remove `prod/rbdr-immutable/backup-0900.tar`. Object, 'backup-0900.tar (Version ID=133fd99f-1f98-41c0-9d08-95e6e2944157)' is WORM protected and cannot be overwritten
>>> exit code: 1

--- can the FULL ADMIN force it? ---
mc: <ERROR> Failed to remove `lab/rbdr-immutable/backup-0900.tar`. Object, 'backup-0900.tar (Version ID=133fd99f-1f98-41c0-9d08-95e6e2944157)' is WORM protected and cannot be overwritten
>>> exit code: 1

The third refusal is the one to record. Under a compliance-mode retention the deployment’s administrator got the same error and exit code as the identity stolen from a production host: the separation between who writes copies and who could destroy them is enforced by the storage, not observed by agreement.

The retention window is arithmetic, not a price: the longest interval this estate has taken to notice an intrusion, plus the time to convene a decision. The offsite mechanism’s behaviour comes from a deletion probe, never from the job’s exit status.

$ rsync -a --delete src/ mirror/

--- mirror now ---
mirror/orders.csv
mirror/reports/q3.txt
invoice.txt recoverable from the mirror? NO - the mirror deleted it too

Elapsed time between the mistake and the loss of the only other copy:
one scheduled interval. Nobody had to make a second mistake.

Access this needs

Read access to every repository’s configuration — retention mode, lifecycle rules, replication rules — and the ability to enumerate every principal holding a bypass or policy-editing right. The production credential itself, borrowed with the service owner’s knowledge, for the deletion attempts.

Off-host log sources for the timeline items: the shipped copy of authentication records, the egress record held by the firewall, proxy or resolver, and the backup platform’s access log. A reviewer who can read only the production host’s own logs cannot complete those items, and that is the finding.

A restore target with no route to production, with capacity for one recovery point.

What the review produces

A dated record naming the reviewer and, per repository: the mode in force, the window in days, and the derivation of that number. Attach the exit code and error text of every deletion attempt, the principals who can shorten or bypass retention, and the elapsed time taken to identify the newest recovery point predating a boundary timestamp chosen at random on the day.

Anything the review could not test — a repository whose credential could not be borrowed, an alert nobody would fire — is recorded as untested, never as passing. The distance between configured and observed is the subject.

Sign-off

• Reviewer: ____ Date: ____
• Backup platform owner: ____ Date: ____
• Security owner: ____ Date: ____

Every critical item passes, or names who accepted the residual risk, and when.