A Swift Ransomware Response is the Path to Business Resiliency

Semperis argues that testing backups under ideal conditions creates only an illusion of resilience; real cyber resilience is about staying recoverable when the plan fails and the assumptions behind it collapse.

CISA's ransomware guidance is a reminder that recovery plans must cover AD: if domain controllers fall, standard backups aren't enough and forest recovery may be needed—keeping offline, non-domain-joined backups (or cloud copies) is decisive.

Making its debut in 2018, the Ryuk ransomware strand has wreaked havoc on hundreds of businesses and is responsible for one-third of all ransomware attacks that took place in 2020.

Explains why hypervisor snapshots of domain controllers can't replace proper AD backups: restores risk lingering objects, replication inconsistency, and USN rollback during forest recovery.

Ransomware makes total AD meltdown realistic, but recovery practice has barely changed in 15 years; DXC's Guido Grillenmeier lists AD recovery dos and don'ts—from detailed plans to offline backups.

AD recovery comes in levels—object, server, domain, attribute—each harder than the last. The post walks through all four before explaining what forest recovery means and when it is required.