Over the weekend I was called on to be part of the incident response team in the middle of a real-time ransomware attack. Their current backup was online, and of course it was encrypted, too. The company’s most recent backup that wasn’t encrypted was about three weeks old, and it was pure chance that the three-week old copy even existed.
[LinkedIn article]