Cyber security and disaster recovery are one subject for a Savannah business, because ransomware crews now go after the backups first. You are protected when one copy of your data sits where no everyday account can delete it, you know how long a full restore takes, and you have proved it by restoring.
People searching for cyber security and backup in the same breath have already worked something out that a lot of IT providers have not: the backup is a security control, not a housekeeping task. Lowcountry Technologies, an IT company in Rincon near Savannah, has watched the two subjects collide on more than one Monday morning. The security product did its job and raised an alert. The backup job had been reporting green for a year. And the first restore anyone had ever attempted was the one that mattered.
This post is for the owner or office manager who has a backup and a security product and has never seen the two tested together. We have already written the long version of the 3-2-1 rule and hurricane-season disaster recovery planning, so we will not repeat it here beyond a sentence. What follows is the part that post did not cover: why attackers hunt backups, what an immutable copy really is, how much data loss you can actually absorb, a restore test you can run in an afternoon, and what the law and the compliance forms expect of you.
Why Do Ransomware Crews Go After the Backups First?
Because a working backup is the one thing that makes the ransom optional. An attacker who encrypts your file server but leaves your backups alone has given you a bad weekend. An attacker who deletes the backups first has given you a choice between paying and starting over. So the crews changed their order of operations. The joint CISA and FBI #StopRansomware Guide puts it plainly: many ransomware variants attempt to find and then delete or encrypt accessible backups, which is exactly why the guide tells businesses to keep offline, encrypted copies of critical data.
The word that matters in that sentence is accessible. A backup that your everyday administrator account can see, browse and delete is accessible to anyone who steals that account, and stealing that account is the whole game. The crews do not need to break your backup software. They log into it. The managed cybersecurity work we do spends as much time on who can reach the backups as on what is backed up, and this is the reason.
What Happens When the Backups Are Compromised
94%
of organizations hit by ransomware said the attackers tried to compromise their backups during the attack, in a survey of nearly 3,000 IT and security professionals whose companies had been hit in the prior year.
57%
of those attempts succeeded. Where they did, the data was far more likely to end up encrypted, and the victims were almost twice as likely to pay the ransom.
8x
higher median recovery cost for businesses whose backups were compromised, compared with those whose backups survived. Ransom demands roughly doubled too.
Source: The Impact of Compromised Backups on Ransomware Outcomes, 2024 survey of 2,974 ransomware victims. For how common ransomware itself is, the Verizon Data Breach Investigations Report now puts it in roughly half of all breaches.
What Is an Immutable Backup, and Why Is a Synced Cloud Folder Not One?
An immutable backup is a copy that nobody can change or delete until a set retention period runs out. Not the attacker, not your IT provider, not you. An offline backup gets to the same place a different way: the copy is disconnected from the network, so there is nothing to log into. A synced cloud folder is neither. It is designed to push every change to every device within minutes, and it does that just as faithfully when the change is ransomware encrypting the files. The copy in the cloud is then a perfect backup of the damage.
In practice a small business ends up with three kinds of copies, and the 3-2-1 rule still describes them well: production data, a local backup for fast everyday restores, and one copy off site and out of reach. The CISA guide notes that some cloud providers offer immutable storage that protects stored data without a separate environment, with a caution that it may not satisfy every regulation, so a regulated business should ask before relying on it alone. What makes any of the three a security control rather than a convenience is credentials. The account that runs the business, the one that gets phished, must not be the account that can empty the backups.
How Many Hours of Invoices Can You Afford to Re-Key?
Two numbers describe every backup plan, and most owners have never been asked for either. The recovery point objective is how much work you are willing to lose, measured in time since the last good copy. The recovery time objective is how long you can be down before the damage stops being an inconvenience. Both are business decisions dressed up as technical ones, so here is the worked example we walk through with clients.
A freight brokerage in Garden City backs up its server once a night at eleven. On Thursday at three in the afternoon, ransomware takes the server. Everything since eleven the night before is gone: sixteen hours of load confirmations, rate quotes, invoices and driver paperwork. That is the recovery point, and the only way to close it is for someone to re-key sixteen hours of work from email and paper. Now the restore itself. Two terabytes of files pulled back over a typical office internet connection takes the better part of a day before anyone can open a document, and that clock starts after somebody finds the backup console password, confirms the copy is clean, and decides where to restore it. Call it two business days before the office is working normally. That is the recovery time.
If two days and sixteen hours of re-keying sounds survivable, the nightly plan is fine and you should spend the money elsewhere. If it sounds like a lost customer or a missed payroll, the fix is specific: back up the systems that produce invoices more often, keep a local copy for the fast restore, and rehearse the process so the human part of the clock shrinks. A plan that cannot state its two numbers is a hope with a monthly fee.
What Does a Restore Test Look Like That You Can Run in an Afternoon?
A backup nobody has restored from is a receipt, not a plan. The CISA guide says to regularly test the availability and integrity of backups in a disaster recovery scenario, and that sounds bigger than it is. Block out an afternoon, bring whoever runs your IT, and do the following with a stopwatch running.
1. Start the clock before you log in. The test begins when you decide to restore, not when the restore starts. Finding the console password, the second factor and the person who knows which job to pick is real recovery time.
2. Restore one file from ninety days ago. Not yesterday. A file from a quarter back proves retention is actually working and that old versions have not been silently pruned to save space.
3. Restore one whole system somewhere isolated. Pick the server or the line-of-business application the invoices come from. Bring it up on spare hardware or in an isolated cloud space, not on top of production, and open a record in it.
4. Try it with the admin account locked out. Pretend the everyday admin credentials are in the attacker’s hands. Can you still reach the off-site or immutable copy with the separate credentials? If the honest answer is no, you found the finding.
5. Write down both numbers and a date. Minutes to the first file, hours to the working system, and when you will do it again. Quarterly is a reasonable rhythm, and once before June is non-negotiable on this coast.
What Do Georgia and South Carolina Breach Laws Mean for Your Backups?
Two things, and owners regularly get them backwards. First, the encryption that matters to the law is the encryption you applied, not the encryption the attacker applied. South Carolina’s statute defines a breach as unauthorized access to and acquisition of computerized data that was not rendered unusable through encryption, redaction, or other methods, and it requires notice to affected residents in the most expedient time possible and without unreasonable delay, with the state’s Consumer Protection Division and the credit bureaus added when more than a thousand people are notified. Georgia’s notice law lives at O.C.G.A. 10-1-910 through 10-1-912, and the National Conference of State Legislatures tracks both alongside every other state’s. Modern crews copy data out before they encrypt it, so “they only encrypted us” is rarely the end of the question. Your attorney gets a call on day one.
Second, backups are where the old data lives. A payroll export from seven years ago, a scanned driver’s license from a former tenant, a client’s tax return from before you switched software: all of it is still personal information if a backup drive walks out of the building or a cloud bucket is left open. Encrypting the backups with keys you hold, and retiring copies you no longer need, is what turns a lost drive into a lost drive instead of a notification letter. Our data protection guide for Bluffton and Beaufort County covers the South Carolina side and encryption at rest in more depth.
What Does “Cybersecurity Compliance” Actually Ask of Your Backups?
More than it used to, and in plainer language. The cyber insurance questionnaire is the version most Savannah owners meet first: it now asks directly whether backups are offline or immutable, whether they are separated from the everyday admin accounts, and when a restore was last tested. We covered the whole form in our post on cyber insurance requirements. Answer those questions wrong and the policy may be written with exclusions you will discover on the worst day.
Regulated businesses have it in writing. The FTC Safeguards Rule, which reaches car dealers, mortgage brokers and tax preparers among others, requires customer information to be encrypted at rest and a written incident response plan designed to respond to and recover from a security event, with notice to the FTC within thirty days when five hundred or more consumers are involved (16 CFR 314.4). The HIPAA Security Rule asks medical and dental practices for a data backup plan and a disaster recovery plan as required elements, and periodic testing of both (45 CFR 164.308). Suppliers to the defense work around Fort Stewart and Hunter are being asked the same questions by their primes. None of these frameworks accept a green checkmark in a console as proof. They want the restore log.
The One-Page Backup Audit to Hand Whoever Runs Your IT
Four questions. Each has a short factual answer, and “I would have to check” is itself an answer. Ask them of your in-house person, your current provider, or any cybersecurity company you are evaluating, and compare what comes back.
Who Can Delete the Backups?
Name the accounts. If the list includes the same administrator login people use every day, or the backups sit in a folder any domain admin can browse, an attacker with one stolen password owns both your data and your copy of it.
Where Is the Copy a Storm or a Crew Cannot Reach?
One copy must be far enough away that an evacuation does not cover it and locked enough that a compromised network cannot touch it. Name the place, the retention period and whether it is immutable, offline, or merely elsewhere.
When Was the Last Restore, and How Long Did It Take?
A date and two numbers: minutes to a single file, hours to a working system. No date means it has not been done. A date with no numbers means nobody timed it, which is the same thing for planning purposes.
How Much Work Sits Between the Last Backup and Now?
State it in hours for the systems that produce invoices and payroll. If the answer is a full day and that day would hurt, the schedule is the fix, and it is usually the cheapest change on this whole page.
Has Anyone Actually Restored Your Backups?
We will run the four-question audit with you, check who can reach your copies, and time a real restore. You get the two numbers in writing and a plain-English list of what to fix, whether or not you ever hire us.
Frequently Asked Questions
Is backup part of cybersecurity or part of IT?
Both, and the distinction is what gets businesses hurt. Backup used to be an IT chore that ran at night. Now it is the control that decides whether a ransomware attack is a bad week or a closed business, so it belongs in the security plan: who can reach the copies, whether one copy is immutable, and how often a restore is tested.
What is the difference between an immutable backup and an offline backup?
An offline backup is physically or logically disconnected from your network, such as a rotated drive in a safe or a tape. An immutable backup stays online but cannot be changed or deleted by anyone, including your own administrator, until a retention period ends. Either one defeats an attacker who has your admin password. A synced cloud folder is neither.
How often should a Savannah business test its backups?
Restore a single file every month and a whole server or system at least once a quarter, and time both. Hurricane season is the natural deadline: prove the restore works before June, when the building may be unreachable for a week. Write the time down. That number, not the green checkmark in the backup console, is your real recovery time.
Does a shared cloud drive or sync folder count as a backup?
No. Sync is built to copy changes everywhere quickly, so when ransomware encrypts the files on one computer, the encrypted versions sync upward within minutes. Version history helps with a handful of files and fails at the scale of a whole company. Keep the sync folder for collaboration and keep a separate backup the sync account cannot touch.
If ransomware encrypts our files, do we have to notify customers under Georgia or South Carolina law?
It depends on whether personal information was accessed or taken, not only whether it was encrypted by the attacker. South Carolina defines a breach as unauthorized access to and acquisition of data that was not rendered unusable through encryption or redaction, and Georgia has its own notice statute. Modern ransomware crews usually copy data out before they encrypt it, so plan on involving your attorney early.
Every other security control on your network is there to keep the bad day from happening. The backup is the only one whose job is to make the bad day survivable, and it is the one most businesses have never watched work. Separate the credentials, put one copy out of reach, and time a restore before hurricane season. Do those three and the ransom note becomes a nuisance instead of a negotiation.
If you would rather someone else own the schedule, the restore tests and the paperwork, that is what our managed IT services for Savannah businesses are built around.
Not sure who can delete your backups, or how long a restore would take? Ask us. Straight answer, no pressure. Call (912) 335-0175.