Facing ransomware risk, a city plans backups for tax and utility billing systems. Which storage strategy is most thoughtful?
Select an answer to reveal the explanation.
Short Explanation
If every spare key hangs on the same hook the burglar already found, you are not backed up. Mix onsite, offsite, and cloud copies with isolation so ransomware cannot eat them all. One online twin of production is a hope, not a strategy.
Full Explanation
Ransomware-resilient backup strategy for municipalities diversifies location and trust boundaries: onsite copies support fast restore, offsite copies survive facility loss, and cloud copies add geographic and often platform diversity—while isolation (immutable storage, offline/air-gapped media, separate identity domains, or delayed replication) prevents a single compromised credential set from encrypting every generation. The goal is that at least one recoverable, integrity-verified copy remains outside the attacker’s reach after production is locked. Testing restores matters as much as taking backups; untested backups are assumptions. Alignment with records retention and privacy rules governs how long and where citizen data copies live.
Keeping only a single always-online backup share on the same domain as production servers places the spare keys on the same ring attackers already hold. Disabling backups entirely to reduce storage cost during budget season trades short-term savings for potentially catastrophic recovery failure. Storing the only backup on the same encrypted volume the malware already targets ensures the backup dies with production. Exam caveat: “3-2-1”-style thinking and immutability are about surviving compromise—not merely satisfying a checkbox that a backup job ran. Operationally, enforce separate backup admin credentials, enable immutable or air-gapped retention for critical systems, and schedule quarterly restore tests with documented success criteria for key citizen services.