How can we protect our cloud infrastructure from sophisticated Ransomware-as-a-Service attacks?

All answers to this question.

Do you currently have a "Break-Glass" account strategy for when your primary SSO provider goes down or is compromised during a security incident?

   Answered 2025-01-05 by Kevin Adams

• We have two break-glass accounts with hardware YubiKeys stored in a physical safe. We’ve tested them once, and it’s a terrifying process but necessary. My concern is that during a ransomware attack, the "delete" commands happen so fast that we might not be able to log in in time to stop the script. That’s why the immutable S3 buckets Heather mentioned seem like the only real fail-safe for us.

     Commented 2025-01-18 by Jason Lee

Regularly testing your "Restore" process is just as important as the backup itself. A backup is useless if the decryption keys are lost in the attack.

   Answered 2025-02-02 by Amanda White

• 100% agree, Amanda. We do a quarterly "Fire Drill" where we restore a random database to a clean environment to ensure our keys and scripts still work.

     Commented 2025-02-10 by Ryan Mitchell

To stop ransomware from deleting backups, you must use "Object Lock" (AWS) or "Immutability Policy" (Azure). This creates a WORM (Write Once, Read Many) state where even the root account cannot delete the data until the retention period expires. For a true air-gap, implement a "Vault" account in a completely separate cloud organization with no VPC peering. Use a pull-based backup mechanism where the Vault account pulls data from the production account. This way, if production is compromised, the attacker has no network path to the Vault. Finally, enforce MFA on all "Delete" actions through a Service Control Policy (SCP) to add a human gate.

   Answered 2025-12-15 by Heather Collins