SCNET · Enterprise IT · Ankara, Türkiye
A ransomware attack begins as a security incident and continues as a continuity crisis. This page addresses the second half: how to come back cleanly once the estate is encrypted.
Having a backup is not enough. Attackers usually target backups first, and a recovery plan has to assume that from the outset.
Recovery rests on a copy that cannot be deleted and is reached independently of production identity. If a production administrator's credentials can reach that copy, so can an attacker.
Restoring into an encrypted network invites the attacker back in. Recovery starts in a separate, clean environment, and systems return to production only after verification.
Which service comes back first is far too important to debate during an attack. The order is set in advance against business impact, and identity and network layers sit at the head of nearly every chain.
Whether to pay is not an IT decision. Decision owners, legal and communication roles are defined in advance, and notification duties and their deadlines belong in the plan.
Backups are necessary but not sufficient. What decides is whether they are isolated from the attacker, restorable into a clean environment, and whether the return order is known.
That is a legal and executive decision, not one for a technical team. The plan's job is to make the decision easier: how realistic the option of recovering without paying actually is should already be measured.
The security side covers preventing and detecting an attack. This page covers what follows one — clean return and the continuity decisions around it.
Do you know today what you would return to from an encrypted estate? Let's start with the scope of your isolated copies.
Review your isolated copiesWe run basic measurement — visits, referring source and page performance — on our own infrastructure in Türkiye; this needs no consent. Advanced measurement, such as form usage and on-page interaction, is processed only with your consent. Declining does not affect your use of the site.
