Offline backups

I was at a security conference, and I heard a talk by Sean McCloskey, the Chief of Cybersecurity for the Cybersecurity and Infrastructure Security Agency (CISA) Region 4. Sean spoke about the importance of good offline backups. He said that every single company that has suffered a ransomware attack where he was part of the incident response did not have good offline backups. Whenever I talk about backups, I always stress that they must be offline. You’re probably asking, What’s the deal with offline backups? Well, with ransomware, it will encrypt all connected online drives. If you are using iCloud or SharePoint as an online backup drive, it will also be encrypted if ransomware is run on your computer. Likewise, any online USB-connected drives will be encrypted.

It’s paramount that you have good offline backups. The way to do this is to configure incremental backups and disconnect access to the drive in between. Windows has a built-in incremental...