What it does. 'Designs a ransomware-resilient backup strategy using the 3-2-1-1-0 Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/implementing-ransomware-backup-strategy/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-ransomware-backup-strategy, or copy the skill folder into ~/.claude/skills/implementing-ransomware-backup-strategy/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ransomware-backup-strategy/SKILL.md

SKILL.md (verbatim)

name: implementing-ransomware-backup-strategy
description: 'Designs a ransomware-resilient backup strategy using the 3-2-1-1-0
  methodology (3 copies, 2 media types, 1 offsite, 1 immutable/air-gapped, 0 restore
  errors), configuring RPO/RTO-aligned schedules, isolating backup credentials, and
  automating restore testing. Use when planning ransomware backup resilience or air-gapped/immutable
  backup architecture.

  '
domain: cybersecurity
subdomain: ransomware-defense
tags:
- ransomware
- backup
- incident-response
- defense
- recovery
- immutable-storage
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_ai_rmf:
- MEASURE-2.7
- MAP-5.1
- MANAGE-2.4
- MANAGE-3.1
- MEASURE-3.1
atlas_techniques:
- AML.T0070
- AML.T0066
- AML.T0082
nist_csf:
- PR.DS-11
- RS.MA-01
- RC.RP-01
- PR.IR-01
mitre_attack:
- T1078
- T1190
- T1059
- T1003
- T1110
mitre_f3:
  version: '1.1'
  tactics:
  - positioning
  - monetization
  techniques:
  - id: T1531
    name: Account Access Removal
    tactic: positioning
    source: attack
  - id: F1018
    name: Convert to Cryptocurrency
    tactic: monetization
    source: f3
  - id: F1047
    name: Transfer of funds
    tactic: monetization
    source: f3
  - id: F1017.001
    name: 'Conversion to Physical Monetary Instruments: Cash'
    tactic: monetization
    source: f3

Implementing Ransomware Backup Strategy

When to Use

• Designing backup architecture that withstands ransomware encryption and deletion attempts
• Migrating from traditional backup to ransomware-resilient backup with immutable storage
• Establishing RPO/RTO targets for critical systems and validating them through restore testing
• Isolating backup credentials and infrastructure from the production Active Directory domain
• Meeting cyber insurance requirements for backup resilience and tested recovery capabilities

Do not use as a substitute for endpoint protection, network segmentation, or incident response planning. Backups are a last line of defense, not a primary prevention control.

Prerequisites

• Inventory of critical systems, applications, and data classified by business impact (Tier 1/2/3)
• Defined RPO (Recovery Point Objective) and RTO (Recovery Time Objective) per tier
• Backup software supporting immutable repositories (Veeam 12+, Commvault, Rubrik, Cohesity)
• Isolated backup network segment or air-gapped storage infrastructure
• Separate backup admin credentials not joined to the production AD domain

Workflow

Step 1: Classify Assets and Define Recovery Objectives

Map all systems into recovery tiers based on business impact:

Tier	Examples	RPO	RTO	Backup Frequency
Tier 1 (Critical)	Domain controllers, ERP, databases	1 hour	4 hours	Hourly incremental, daily full
Tier 2 (Important)	File servers, email, web apps	4 hours	12 hours	Every 4 hours incremental, daily full
Tier 3 (Standard)	Dev environments, archives	24 hours	48 hours	Daily incremental, weekly full

Document dependencies between systems. Domain controllers and DNS must recover before application servers. Database servers before application tiers.

Step 2: Implement 3-2-1-1-0 Architecture

Configure backup storage following the extended 3-2-1-1-0 rule:

Copy 1 - Primary backup on local storage:

# Veeam backup job targeting local repository
# Fast restore for operational recovery
Backup Repository: Local NAS (CIFS/NFS) or SAN
Retention: 14 days of restore points
Encryption: AES-256 with password not stored in AD

Copy 2 - Secondary backup on different media:

# Replicate to secondary site or cloud
# Veeam Backup Copy Job or Scale-Out Backup Repository
Target: AWS S3 / Azure Blob / Wasabi / tape library
Retention: 30 days
Transfer: Encrypted TLS 1.2+ in transit

Copy 3 - Offsite copy:

# Geographically separated from primary and secondary
# Cloud object storage in different region or physical tape rotation
Target: Cross-region cloud storage or Iron Mountain tape vaulting
Retention: 90 days

+1 - Immutable or air-gapped copy:

# Cannot be modified or deleted for defined retention period
# Veeam Hardened Repository on Linux with immutable flag
# Or AWS S3 Object Lock in Compliance mode
# Or physical air-gapped tape

+0 - Zero errors on restore verification:

# Automated restore testing using Veeam SureBackup or equivalent
# Scheduled weekly for Tier 1, monthly for Tier 2/3
# Verify boot, network connectivity, and application health

Step 3: Isolate Backup Credentials

Ransomware operators target backup infrastructure by compromising backup admin credentials through Active Directory:

1. Separate backup admin accounts from the production AD domain. Use local accounts on backup servers or a dedicated backup management domain.
2. Dedicated backup network segment with firewall rules allowing only backup traffic (specific ports, specific source/destination IPs).
3. MFA on backup console access using hardware tokens or authenticator apps, not SMS.
4. Disable RDP on backup servers. Use out-of-band management (iLO/iDRAC/IPMI) for emergency access.
5. Remove backup servers from domain or place in a dedicated OU with restricted GPO inheritance.

# Linux Hardened Repository - disable SSH password auth
sudo sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

# Set immutable flag on backup files (XFS filesystem)
sudo chattr +i /mnt/backup/repository/*

# Veeam Hardened Repository uses single-use credentials
# that are not stored on the Veeam server after initial setup

Step 4: Configure Immutable Storage

Veeam Hardened Linux Repository:

# Minimal Ubuntu 22.04 LTS installation
# No GUI, no unnecessary services
# Veeam uses temporary SSH credentials during backup window only

# Configure XFS with reflink support
sudo mkfs.xfs -b size=4096 -m reflink=1 /dev/sdb1
sudo mount /dev/sdb1 /mnt/veeam-repo

# Create dedicated Veeam user with limited permissions
sudo useradd -m -s /bin/bash veeamuser
sudo mkdir -p /mnt/veeam-repo/backups
sudo chown veeamuser:veeamuser /mnt/veeam-repo/backups

AWS S3 Object Lock (Compliance Mode):

# Create bucket with Object Lock enabled
aws s3api create-bucket \
  --bucket company-immutable-backups \
  --object-lock-enabled-for-bucket \
  --region us-east-1

# Set default retention - 30 days compliance mode
aws s3api put-object-lock-configuration \
  --bucket company-immutable-backups \
  --object-lock-configuration '{
    "ObjectLockEnabled": "Enabled",
    "Rule": {
      "DefaultRetention": {
        "Mode": "COMPLIANCE",
        "Days": 30
      }
    }
  }'

Azure Immutable Blob Storage:

# Create storage account with immutable storage
az storage container immutability-policy create \
  --account-name backupaccount \
  --container-name immutable-backups \
  --period 30

# Lock the policy (irreversible)
az storage container immutability-policy lock \
  --account-name backupaccount \
  --container-name immutable-backups

Step 5: Automate Restore Testing

Configure automated restore verification on a recurring schedule:

# Veeam SureBackup verification job (PowerShell)
# Tests VM boot, network ping, and application health

Add-PSSnapin VeeamPSSnapin
$backupJob = Get-VBRJob -Name "Tier1-DailyBackup"
$sureBackupJob = Get-VSBJob -Name "Tier1-RestoreTest"

# Verify last restore test completed successfully
$lastSession = Get-VSBSession -Job $sureBackupJob -Last
if ($lastSession.Result -ne "Success") {
    Send-MailMessage -To "backup-team@company.com" `
        -Subject "ALERT: SureBackup verification failed" `
        -Body "Tier 1 restore test failed. Last result: $($lastSession.Result)" `
        -SmtpServer "smtp.company.com"
}

Document restore test results and maintain a recovery runbook with step-by-step procedures for each tier.

Key Concepts

Term	Definition
3-2-1-1-0	Extended backup rule: 3 copies, 2 media types, 1 offsite, 1 immutable/air-gapped, 0 restore verification errors
RPO	Recovery Point Objective: maximum acceptable data loss measured in time (e.g., 1 hour RPO means max 1 hour of data loss)
RTO	Recovery Time Objective: maximum acceptable downtime before system must be operational
Immutable Backup	Backup copy that cannot be modified, encrypted, or deleted for a defined retention period, even by administrators
Air-Gapped Backup	Physically isolated backup with no network connectivity to production systems, providing strongest ransomware protection
Hardened Repository	Linux-based backup storage with minimal attack surface, no persistent SSH, and immutable file flags

Tools & Systems

• Veeam Backup & Replication 12: Enterprise backup with Hardened Linux Repository, SureBackup verification, and immutable backup support
• Rubrik Security Cloud: Zero-trust backup platform with immutable snapshots, anomaly detection, and air-gapped recovery
• Commvault: Backup with Metallic air-gap protection, anomaly detection, and automated recovery orchestration
• AWS S3 Object Lock: Cloud-native immutable storage in Compliance or Governance mode for backup copies
• Cohesity DataProtect: Backup platform with DataLock immutability, anti-ransomware detection, and instant mass restore

Common Scenarios

Scenario: Financial Services Firm Implementing Ransomware-Resilient Backup

Context: A mid-size bank with 500 servers, 200TB of data, and regulatory requirements for 7-year retention must redesign backup after a peer institution was hit by ransomware. Current backups use a single Veeam repository on a Windows server joined to the production domain.

Approach:

1. Classify all 500 servers into three tiers: 50 Tier 1 (core banking, AD, DNS), 200 Tier 2 (email, file shares, web), 250 Tier 3 (dev, test, archive)
2. Deploy Veeam Hardened Linux Repository on dedicated Ubuntu 22.04 servers with XFS immutability for primary backup
3. Configure S3 Object Lock in Compliance mode for 30-day immutable cloud copy with Veeam Scale-Out Repository capacity tier
4. Establish quarterly tape rotation to Iron Mountain for 7-year regulatory retention
5. Remove all backup servers from the production AD domain and create isolated backup admin accounts with hardware MFA tokens
6. Deploy SureBackup jobs: weekly for Tier 1, monthly for Tier 2, quarterly for Tier 3
7. Conduct annual full recovery drill restoring AD, DNS, core banking, and dependent applications to validate documented RTO

Pitfalls:

• Leaving backup admin credentials in the production AD domain where ransomware operators can compromise them via Kerberoasting or DCSync
• Configuring immutable retention periods shorter than the dwell time of typical ransomware (average 21 days), allowing attackers to wait for immutability to expire
• Testing only individual VM restores without testing full application stack recovery including dependencies
• Forgetting to back up backup server configuration (Veeam config database, encryption keys) separately from the backup infrastructure itself

Output Format

## Ransomware Backup Strategy Assessment

**Organization**: [Name]
**Assessment Date**: [Date]
**Assessor**: [Name]

### Current State
- Backup Solution: [Product/Version]
- Copies: [Number and locations]
- Immutable Copy: [Yes/No - Details]
- Air-Gapped Copy: [Yes/No - Details]
- Credential Isolation: [Yes/No - Details]
- Last Restore Test: [Date - Result]

### Gap Analysis
| Control | Current | Target | Gap | Priority |
|---------|---------|--------|-----|----------|
| Immutable backup | None | S3 Object Lock + Linux Hardened Repo | Missing | Critical |
| Credential isolation | Domain-joined | Standalone local accounts + MFA | Partial | Critical |
| Restore testing | Ad-hoc manual | Automated weekly SureBackup | Missing | High |

### Recommendations
1. [Priority] [Recommendation] - [Estimated effort]
2. ...

### Recovery Tier Summary
| Tier | Systems | RPO | RTO | Backup Schedule | Restore Test Frequency |
|------|---------|-----|-----|-----------------|----------------------|
| 1 | 50 | 1hr | 4hr | Hourly inc/Daily full | Weekly |
| 2 | 200 | 4hr | 12hr | 4hr inc/Daily full | Monthly |
| 3 | 250 | 24hr | 48hr | Daily inc/Weekly full | Quarterly |

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Ransomware Backup Strategy Assessment Template

Organization Information

Field	Value
Organization Name
Assessment Date
Assessor Name
Backup Solution
Number of Servers
Total Data Volume

Current Backup Architecture

Backup Copies Inventory

Copy #	Location	Media Type	Offsite?	Immutable?	Air-Gapped?	Retention	Encrypted?	Last Successful
1
2
3

3-2-1-1-0 Compliance Checklist

• 3 Copies: At least 3 copies of data exist
• 2 Media Types: Backups stored on at least 2 different media types
• 1 Offsite: At least 1 copy stored offsite or in a different geographic location
• 1 Immutable/Air-Gapped: At least 1 copy is immutable or physically air-gapped
• 0 Errors: Automated restore testing passes with zero errors

Recovery Tier Classification

Tier 1 - Critical Systems

System	RPO Target	RTO Target	Backup Frequency	Dependencies

Tier 2 - Important Systems

System	RPO Target	RTO Target	Backup Frequency	Dependencies

Tier 3 - Standard Systems

System	RPO Target	RTO Target	Backup Frequency	Dependencies

Credential Isolation Assessment

Control	Status	Evidence
Backup servers removed from production AD	Yes / No
Dedicated backup admin accounts	Yes / No
MFA enabled for backup console	Yes / No
Backup network segmented	Yes / No
RDP disabled on backup servers	Yes / No
Backup encryption keys stored separately	Yes / No

Restore Testing History

Date	Tier	Systems Tested	Result	RTO Achieved	Issues

Gap Analysis

Control	Current State	Target State	Gap	Priority	Effort
Immutable backup
Credential isolation
Restore testing
Offsite copy
Encryption

Recommendations

Critical Priority

1. [Finding]: [Recommendation] - Estimated effort: [X days/weeks]

High Priority

1. [Finding]: [Recommendation] - Estimated effort: [X days/weeks]

Medium Priority

1. [Finding]: [Recommendation] - Estimated effort: [X days/weeks]

Recovery Runbook Checklist

Pre-Recovery

• Incident declared and scope determined
• Affected systems isolated from network
• Backup integrity verified (immutable copies confirmed clean)
• Backup timestamps verified to predate infection
• Recovery environment prepared (clean network, fresh OS images)

Recovery Execution

• Phase 1: Identity infrastructure (AD, DNS, DHCP)
• Phase 2: Tier 1 critical systems
• Phase 3: Tier 2 important systems
• Phase 4: Tier 3 standard systems
• Each restored system validated before connecting to network

Post-Recovery

• All restored systems scanned for persistence mechanisms
• Security controls validated (EDR, firewall rules, MFA)
• Users notified and credentials reset
• Recovery time documented against RTO targets
• Lessons learned documented

Sign-Off

Role	Name	Signature	Date
IT Director
CISO
Backup Admin

references/api-reference.md (verbatim)

API Reference: Ransomware Backup Strategy Audit

Libraries Used

Library	Purpose
boto3	AWS SDK for S3, AWS Backup, and IAM auditing
json	Parse backup policies and compliance data
subprocess	Run local backup verification commands
datetime	Calculate backup age and RPO/RTO compliance

Installation

pip install boto3

Authentication

import boto3
import os

session = boto3.Session(
    aws_access_key_id=os.environ.get("AWS_ACCESS_KEY_ID"),
    aws_secret_access_key=os.environ.get("AWS_SECRET_ACCESS_KEY"),
    region_name=os.environ.get("AWS_REGION", "us-east-1"),
)

s3 = session.client("s3")
backup = session.client("backup")
iam = session.client("iam")

AWS S3 Backup Audit

Check Bucket Versioning (Ransomware Recovery)

def audit_s3_versioning():
    findings = []
    buckets = s3.list_buckets()["Buckets"]
    for bucket in buckets:
        name = bucket["Name"]
        versioning = s3.get_bucket_versioning(Bucket=name)
        status = versioning.get("Status", "Disabled")
        mfa_delete = versioning.get("MFADelete", "Disabled")

        if status != "Enabled":
            findings.append({
                "bucket": name,
                "issue": "Versioning not enabled",
                "severity": "high",
                "remediation": "Enable versioning for ransomware recovery",
            })
        if mfa_delete != "Enabled":
            findings.append({
                "bucket": name,
                "issue": "MFA Delete not enabled",
                "severity": "medium",
                "remediation": "Enable MFA Delete to prevent bulk deletion",
            })
    return findings

Check Object Lock (Immutable Backups)

def check_object_lock(bucket_name):
    try:
        config = s3.get_object_lock_configuration(Bucket=bucket_name)
        lock = config["ObjectLockConfiguration"]
        rule = lock.get("Rule", {}).get("DefaultRetention", {})
        return {
            "bucket": bucket_name,
            "object_lock_enabled": lock.get("ObjectLockEnabled") == "Enabled",
            "retention_mode": rule.get("Mode", "NONE"),
            "retention_days": rule.get("Days", 0),
        }
    except s3.exceptions.ClientError:
        return {"bucket": bucket_name, "object_lock_enabled": False}

Check Cross-Region Replication

def check_cross_region_replication(bucket_name):
    try:
        repl = s3.get_bucket_replication(Bucket=bucket_name)
        rules = repl["ReplicationConfiguration"]["Rules"]
        return {
            "bucket": bucket_name,
            "replication_enabled": True,
            "destinations": [
                r["Destination"]["Bucket"] for r in rules if r["Status"] == "Enabled"
            ],
        }
    except s3.exceptions.ClientError:
        return {"bucket": bucket_name, "replication_enabled": False}

AWS Backup Service

List Backup Plans

def list_backup_plans():
    plans = backup.list_backup_plans()["BackupPlansList"]
    result = []
    for plan in plans:
        detail = backup.get_backup_plan(BackupPlanId=plan["BackupPlanId"])
        rules = detail["BackupPlan"]["Rules"]
        result.append({
            "name": plan["BackupPlanName"],
            "id": plan["BackupPlanId"],
            "rules": [
                {
                    "name": r["RuleName"],
                    "schedule": r.get("ScheduleExpression"),
                    "lifecycle_delete_days": r.get("Lifecycle", {}).get("DeleteAfterDays"),
                    "lifecycle_cold_days": r.get("Lifecycle", {}).get("MoveToColdStorageAfterDays"),
                    "target_vault": r["TargetBackupVaultName"],
                }
                for r in rules
            ],
        })
    return result

Audit Backup Vault Access Policy

def audit_vault_access(vault_name):
    try:
        policy = backup.get_backup_vault_access_policy(BackupVaultName=vault_name)
        policy_doc = json.loads(policy["Policy"])
        # Check for overly permissive policies
        findings = []
        for stmt in policy_doc.get("Statement", []):
            if stmt.get("Effect") == "Allow" and stmt.get("Principal") == "*":
                findings.append({
                    "vault": vault_name,
                    "issue": "Vault policy allows public access",
                    "severity": "critical",
                })
        return findings
    except backup.exceptions.ClientError:
        return [{"vault": vault_name, "issue": "No access policy set", "severity": "medium"}]

List Recovery Points (Check Backup Freshness)

from datetime import datetime, timezone

def check_backup_freshness(vault_name, max_age_hours=24):
    recovery_points = backup.list_recovery_points_by_backup_vault(
        BackupVaultName=vault_name, MaxResults=100
    )["RecoveryPoints"]

    stale = []
    for rp in recovery_points:
        age = datetime.now(timezone.utc) - rp["CreationDate"]
        if age.total_seconds() > max_age_hours * 3600:
            stale.append({
                "resource": rp["ResourceArn"],
                "last_backup": rp["CreationDate"].isoformat(),
                "age_hours": round(age.total_seconds() / 3600),
                "status": rp["Status"],
            })
    return stale

3-2-1 Backup Rule Audit

def audit_321_rule(bucket_name):
    """Verify the 3-2-1 backup rule: 3 copies, 2 media types, 1 offsite."""
    versioning = s3.get_bucket_versioning(Bucket=bucket_name)
    replication = check_cross_region_replication(bucket_name)
    object_lock = check_object_lock(bucket_name)

    score = {
        "three_copies": versioning.get("Status") == "Enabled",
        "two_media": replication["replication_enabled"],
        "one_offsite": replication["replication_enabled"],
        "immutable": object_lock["object_lock_enabled"],
    }
    score["compliant"] = all([score["three_copies"], score["two_media"], score["one_offsite"]])
    return score

Output Format

{
  "audit_date": "2025-01-15",
  "backup_strategy": {
    "total_buckets": 15,
    "versioning_enabled": 12,
    "object_lock_enabled": 5,
    "cross_region_replication": 8,
    "three_two_one_compliant": 4
  },
  "backup_plans": 3,
  "recovery_points_stale": 2,
  "findings": [
    {
      "resource": "critical-data-bucket",
      "issue": "No Object Lock — vulnerable to ransomware deletion",
      "severity": "high",
      "remediation": "Enable S3 Object Lock in COMPLIANCE mode"
    }
  ]
}

references/standards.md (verbatim)

Standards & References - Ransomware Backup Strategy

Industry Standards

NIST SP 800-209: Security Guidelines for Storage Infrastructure

• Defines security controls for storage systems including backup infrastructure
• Covers access control, encryption, integrity verification, and audit logging for storage
• Section 5.3: Backup and recovery security controls

NIST IR 8374: Ransomware Risk Management

• Identifies backup as a critical control in the Recover function
• Recommends maintaining offline, encrypted backups with regular testing
• Emphasizes credential separation for backup administration

CISA #StopRansomware Guide (2023, updated 2025)

• Prescribes 3-2-1 backup rule as baseline, recommends extending to 3-2-1-1-0
• Mandates backup credential isolation from production domains
• Requires documented and tested recovery procedures

CIS Controls v8

• Control 11: Data Recovery
  • 11.1: Establish and maintain a data recovery process
  • 11.2: Perform automated backups
  • 11.3: Protect recovery data (encryption, access control)
  • 11.4: Establish and maintain an isolated instance of recovery data (air-gapped/immutable)
  • 11.5: Test data recovery

ISO 27001:2022

• A.8.13: Information backup
• A.8.14: Redundancy of information processing facilities

Regulatory Requirements

PCI DSS v4.0

• Requirement 9.4.1: Backup media physically secured
• Requirement 12.10.1: Incident response plan includes recovery procedures

HIPAA Security Rule

• 45 CFR 164.308(a)(7): Contingency plan including data backup, disaster recovery, emergency mode operation
• 45 CFR 164.312(a)(2)(ii): Emergency access procedure

SOX

• Section 302/404: Internal controls over financial reporting must include IT controls for data backup and recovery

Vendor Documentation

Veeam

• Hardened Repository Guide: https://helpcenter.veeam.com/docs/backup/vsphere/hardened_repository.html
• SureBackup: https://helpcenter.veeam.com/docs/backup/vsphere/surebackup_job.html
• Immutability: https://helpcenter.veeam.com/docs/backup/vsphere/immutability.html

AWS

• S3 Object Lock: https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html
• AWS Backup Vault Lock: https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html

Azure

• Immutable Blob Storage: https://learn.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview
• Azure Backup Immutable Vault: https://learn.microsoft.com/en-us/azure/backup/backup-azure-immutable-vault-concept

references/workflows.md (verbatim)

Workflows - Ransomware Backup Strategy

Workflow 1: Initial Backup Architecture Design

Start
  |
  v
[Inventory all systems and data] --> Classify into Tier 1/2/3 by business impact
  |
  v
[Define RPO/RTO per tier] --> Document in recovery plan
  |
  v
[Select backup platform] --> Veeam / Rubrik / Commvault / Cohesity
  |
  v
[Design 3-2-1-1-0 architecture]
  |-- Copy 1: Local repository (fast restore)
  |-- Copy 2: Secondary site/cloud (different media)
  |-- Copy 3: Offsite (geographic separation)
  |-- +1: Immutable or air-gapped copy
  |-- +0: Automated restore verification
  |
  v
[Isolate backup credentials]
  |-- Remove from production AD
  |-- Deploy MFA for backup admin access
  |-- Segment backup network
  |
  v
[Configure immutable storage]
  |-- Linux Hardened Repository (XFS immutability)
  |-- S3 Object Lock / Azure Immutable Blob
  |-- Tape air-gap rotation
  |
  v
[Set backup schedules per tier]
  |
  v
[Configure automated restore testing]
  |-- SureBackup / SureReplica
  |-- Verify boot, network, application health
  |
  v
[Document recovery runbook]
  |
  v
End

Workflow 2: Restore Verification Process

Start (Scheduled - Weekly for Tier 1, Monthly for Tier 2)
  |
  v
[SureBackup job triggers VM restore to isolated sandbox]
  |
  v
[VM boots in isolated network segment]
  |
  v
[Heartbeat check] -- Fail --> Alert backup team
  |
  Pass
  |
  v
[Network ping check] -- Fail --> Alert backup team
  |
  Pass
  |
  v
[Application-specific check]
  |-- AD: LDAP query test
  |-- SQL: Database consistency check
  |-- Web: HTTP 200 response
  |-- Email: SMTP handshake
  |
  Fail --> Alert backup team with diagnostic details
  |
  Pass
  |
  v
[Log successful restore] --> Update compliance dashboard
  |
  v
[Clean up sandbox VMs]
  |
  v
End

Workflow 3: Emergency Ransomware Recovery

Ransomware Incident Declared
  |
  v
[Isolate affected systems from network]
  |
  v
[Verify backup integrity]
  |-- Check immutable copies are unaffected
  |-- Validate backup timestamps predate infection
  |-- Scan backup files for ransomware artifacts
  |
  v
[Determine recovery scope]
  |-- Full environment rebuild vs. selective restore
  |-- Prioritize by tier: AD/DNS first, then Tier 1, then Tier 2/3
  |
  v
[Rebuild infrastructure in clean environment]
  |-- Deploy clean OS images
  |-- Restore AD from immutable backup
  |-- Validate AD integrity with ADRestore/DSInternals
  |
  v
[Restore applications in dependency order]
  |-- Database servers before application servers
  |-- Internal services before external-facing
  |
  v
[Validate restored systems]
  |-- Application functionality testing
  |-- Data integrity verification
  |-- Security control validation
  |
  v
[Reconnect to network in phases]
  |-- Monitor for re-infection indicators
  |-- Validate no persistence mechanisms in restored systems
  |
  v
[Post-recovery documentation and lessons learned]
  |
  v
End

Workflow 4: Backup Health Monitoring

Daily Automated Check
  |
  v
[Query backup job status via API/PowerShell]
  |
  v
[Check for failed or warning jobs]
  |-- Failed --> Create P1 ticket, alert backup team
  |-- Warning --> Create P3 ticket, investigate within 24hr
  |-- Success --> Log and continue
  |
  v
[Verify backup repository capacity]
  |-- >85% utilization --> Alert for capacity planning
  |-- >95% utilization --> Critical alert, backup jobs at risk
  |
  v
[Check immutable copy synchronization]
  |-- Verify last immutable copy is within RPO window
  |-- Alert if immutable copy is stale
  |
  v
[Generate weekly backup health report]
  |-- Success rate percentage
  |-- Data protected volume
  |-- Restore test results
  |-- Capacity forecast
  |
  v
End

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.