SQL SERVER – Ransomware Protection and Recoverable Offline Backups

Ransomware recovery depends on protected backups and controlled access. I test whether those recovery copies survive the loss of normal systems.

When I first wrote about ransomware, more than eight customers had called during one busy weekend. Backups and preparation helped us recover those affected environments. That experience made me pay closer attention to the recovery copy itself.

Keep a recovery copy out of reach

Keep protected backups separate from the database server. An offline copy is disconnected after the backup finishes. An immutable copy needs retention and access controls that an attacker can’t easily change. A network share alone does not create either protection.

Test a restore into a separate environment. Record which backup files and keys are required and how long recovery takes. Encryption, retention, and a successful backup message don’t replace that exercise.

Reduce the paths into the server

Keep casual web browsing and email off the database server. Use individual administrative accounts, limited permissions, and approved network access. Segmentation reduces exposure; it does not guarantee that an attacker can’t cross the boundary.

Protect and patch the operating system

My older advice discouraged antivirus software on a database server because of performance concerns. That is too broad. Choose endpoint protection with the security team, apply the appropriate SQL Server exclusions, and test under representative load.

Use a tested patching process and prioritize urgent security fixes. Don’t treat an arbitrary waiting period as protection against ransomware. The risk of delaying a fix belongs in the same discussion as application compatibility.

Review the recovery plan

Ask who owns backup retention, who can delete recovery copies, and how an isolated restore will be performed. Keep the contact and response procedures available when normal systems are inaccessible. If you need help reviewing your SQL Server recovery arrangements, the consulting link below explains my current services.

Related reading

• SQL SERVER – Backup Timeline and Understanding of Database Restore Process in Full Recovery Model
• Take Database Backup using SSMS – SQL in Sixty Seconds #037
• Restore SQL Database using SSMS – SQL in Sixty Seconds #044
• When was Database Last Backed Up with SQL Server?
• Comprehensive Database Performance Health Check

A reachable backup is not automatically a protected backup, it is a recovery copy whose deletion controls need testing.

Published by Pinal Dave on SQLAuthority. More of my work at pinaldave.com.