How can you protect your backups from ransomware and other cyber threats?

Here's my perspective, focusing on the less obvious aspects of backup protection: Encryption Isn't Enough: If the attacker steals your encryption key, the data is theirs. Strong key management practices are vital. "Offline" Is Tricky: A backup drive plugged in all the time is an online target. Have a schedule for when backups are connected/disconnected to reduce risk. Beware the Restore: If your backup IS compromised, restoring it can reinfect your network. Scan restored data BEFORE putting it back in production. Early in my career, I felt like a good backup was just about having extra copies. Now I realize it's a critical part of incident response. Your backups may be the ONLY thing saving you after an attack.

Here's my take, focusing on the less obvious ways access control can break down: The "Who" Beyond the IT Team: Do executives have access to backups for "emergency" reasons? This is often a HUGE security hole, as their accounts are high-value targets for hackers. "Need-to-Know" Changes: A person who needed access yesterday might not today. Review those permissions regularly, not just during onboarding/offboarding. Beware the "Backup Admin" Account: Often shared, rarely changed... this is prime picking for an attacker. Make individual accounts mandatory, even for restores. Early in my career, I focused on technical controls. Now I realize the most common way backups fail is human error.

Your backup strategy is truly the way to secure your protected data. It incorporates the deliberate planning for a cyber event. It requires that you think about all the ways to secure your data and consciously apply each technique. Whether air-gapping, off-siting, MFA, etc. Each of these tools is part of a good backup strategy. By taking a proactive approach to not just what data you protect, but how it is protected, you have ensured your data is cyber-resilient.