Protecting Your Backups from Ransomware

·30 min·2 clips

Heath Renfro says 95% of backups fail in ransomware events, with only one lucky case surviving due to older technology.

The episode begins with host David Spark introducing the topic of backups as a vulnerable yet essential part of cybersecurity resilience. Co-host DJ Schleen, former security lead at Yahoo, joins to discuss common backup failures, such as assumptions about cloud backups and lack of testing. Guest Heath Renfro, co-founder of Phoenix24 and Conversant Group, shares his firsthand experience from responding to over 1200 ransomware events. He reveals that 95% of backups do not survive these attacks, with only one notable exception involving older technology that confused attackers. The conversation includes quotes from cybersecurity professionals like Dwayne Graham and Mike Elkins, emphasizing the need for robust backup strategies. Heath advises against stopping ransomware encryption mid-process to avoid permanent data loss. The 3-2-1-1-0 backup rule is discussed as a framework for resilience, with Heath advocating for immutable storage and frequent testing. DJ Schleen highlights the rarity of dedicated backup testing roles in organizations. Heath describes nightmare scenarios, including multiple ransomware groups encrypting the same data simultaneously, requiring complex negotiations. The episode also touches on business impact analysis, with examples like MGM losing $10-12 million daily during downtime. Heath explains that backup failures stem from cost, IT understaffing, and gaps between security and IT knowledge. The sponsor, Conversant Group, promotes their Securitas Suma program for assured recovery. In closing, Heath recommends his Ransom Backup Resiliency Assessment, noting that none of the assessed companies had backups that would survive a ransomware event.

As heard by us

Backups are treated as the safety net, with recovery and restoration kept firmly on practical ground.

Defense In-Depth keeps its attention on resilience after an attack, treating backups as a safety net that can still be exposed. David Spark and DJ Schleen move through recovery, restoration, business continuity, immutable systems, and infrastructure as code, so the conversation…

Read the full review in PlayNext →

Why you'd press play

When ransomware hits, you want backups that recover, not a polite line item in a binder.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Defense in Depth