Your Active Directory was compromised, is it all lost? – Part 2

CISA's ransomware guidance is a reminder that recovery plans must cover AD: if domain controllers fall, standard backups aren't enough and forest recovery may be needed—keeping offline, non-domain-joined backups (or cloud copies) is decisive.

Making its debut in 2018, the Ryuk ransomware strand has wreaked havoc on hundreds of businesses and is responsible for one-third of all ransomware attacks that took place in 2020.

Semperis argues that testing backups under ideal conditions creates only an illusion of resilience; real cyber resilience is about staying recoverable when the plan fails and the assumptions behind it collapse.

Ransomware makes total AD meltdown realistic, but recovery practice has barely changed in 15 years; DXC's Guido Grillenmeier lists AD recovery dos and don'ts—from detailed plans to offline backups.

AD recovery comes in levels—object, server, domain, attribute—each harder than the last. The post walks through all four before explaining what forest recovery means and when it is required.

Semperis' CEO contrasts fast vs. slow ransomware recoveries: resilient firms automate and test recovery. Advises offline/offsite backups and rehearsed plans, citing MGM and Henry Schein.