Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Orrin Engineering takes nightly backups to disks stored in the same server room as the production servers. After a ransomware attack that also encrypted the connected backup disks, the company cannot recover. Which weakness in its backup strategy is the most fundamental, and what does best practice imply?

The fundamental weakness is that backups were neither isolated nor held offsite, so the attack destroyed them along with production data. Best practice keeps at least one copy offline or offsite on separate media and regularly tests that restoration actually works.

  1. ABackups were too frequent; reduce them to weekly to limit exposure
  2. BBackups were not isolated or offsite; keep at least one copy offline or offsite and test restoresCorrect
  3. CDisks were used instead of tape; media type alone decides resilience
  4. DBackups were not encrypted; encryption would have stopped the ransomware spreading

Explanation

Backups on the same network and in the same room share the same risk as production data. Best practice keeps multiple copies, on different media, with one offsite or offline, and regularly tests restoration. Reducing frequency worsens data loss, media type is not the issue, and encrypting backups does not stop ransomware reaching them.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions