Also known as: 3-2-1 backup · immutable backup · disaster recovery
Backup and recovery is the practice of maintaining recoverable copies of data and systems, and verifying that restoration actually works, so that an organisation can recover from destruction, corruption, or ransomware.
The conventional 3-2-1 rule calls for three copies of data, on two different media, with one held offsite. Ransomware has added a fourth requirement: at least one copy must be immutable or otherwise inaccessible from production credentials, because attackers routinely destroy reachable backups before deploying encryption.
The single most common failure is untested restores. Backup jobs that report success can still produce unrecoverable data, and organisations frequently discover their actual recovery time is measured in weeks rather than the hours assumed by their plan.
Ransomware
Ransomware is malicious software that denies an organisation access to its own data — historically by encrypting it — and demands payment in exchange for restoring access or withholding publication of stolen data.
Incident Response
Incident response is the structured process an organisation follows to detect, contain, eradicate, and recover from a security incident, and to learn from it afterwards.
Tabletop Exercise
A tabletop exercise is a discussion-based simulation in which a team walks through their response to a hypothetical security incident, testing decision-making and procedures without touching production systems.
Double Extortion
Double extortion is a ransomware tactic in which attackers steal a copy of an organisation's data before encrypting it, so that refusing to pay risks both operational disruption and public release of the stolen information.