[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFBJ6VPQ845NK29S31FFBJ":3,"skill-same:01M6AFBJ6VPQ845NK29S31FFBJ":157},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":98,"commitSha":99,"skillDirectory":100,"forksCount":101,"repositoryHtmlUrl":102,"repositoryHomepageUrl":103,"ownerHtmlUrl":104,"ownerBlogUrl":105,"ownerDescription":106,"updatedAt":107,"install":108,"resources":121},"01M6AFBJ6VPQ845NK29S31FFBJ","implementing-ransomware-backup-strategy",null,"Designs a ransomware-resilient backup strategy using the 3-2-1-1-0 methodology (3 copies, 2 media types, 1 offsite, 1 immutable\u002Fair-gapped, 0 restore errors), configuring RPO\u002FRTO-aligned schedules, isolating backup credentials, and automating restore testing. Use when planning ransomware backup resilience or air-gapped\u002Fimmutable backup architecture.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ransomware-backup-strategy\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"implementing ransomware backup strategy","backup","ransomware","methodology","immutable-storage","recovery","immutable","t1059","t1078","t1003","defense","testing","cryptocurrency","incident-response","planning","pr","resilience","architecture","storage","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-ransomware-backup-strategy\ndescription: 'Designs a ransomware-resilient backup strategy using the 3-2-1-1-0\n  methodology (3 copies, 2 media types, 1 offsite, 1 immutable\u002Fair-gapped, 0 restore\n  errors), configuring RPO\u002FRTO-aligned schedules, isolating backup credentials, and\n  automating restore testing. Use when planning ransomware backup resilience or air-gapped\u002Fimmutable\n  backup architecture.\n\n  '\ndomain: cybersecurity\nsubdomain: ransomware-defense\ntags:\n- ransomware\n- backup\n- incident-response\n- defense\n- recovery\n- immutable-storage\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\n- MANAGE-3.1\n- MEASURE-3.1\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nnist_csf:\n- PR.DS-11\n- RS.MA-01\n- RC.RP-01\n- PR.IR-01\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1003\n- T1110\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - positioning\n  - monetization\n  techniques:\n  - id: T1531\n    name: Account Access Removal\n    tactic: positioning\n    source: attack\n  - id: F1018\n    name: Convert to Cryptocurrency\n    tactic: monetization\n    source: f3\n  - id: F1047\n    name: Transfer of funds\n    tactic: monetization\n    source: f3\n  - id: F1017.001\n    name: 'Conversion to Physical Monetary Instruments: Cash'\n    tactic: monetization\n    source: f3\n---\n# Implementing Ransomware Backup Strategy\n\n## When to Use\n\n- Designing backup architecture that withstands ransomware encryption and deletion attempts\n- Migrating from traditional backup to ransomware-resilient backup with immutable storage\n- Establishing RPO\u002FRTO targets for critical systems and validating them through restore testing\n- Isolating backup credentials and infrastructure from the production Active Directory domain\n- Meeting cyber insurance requirements for backup resilience and tested recovery capabilities\n\n**Do not use** as a substitute for endpoint protection, network segmentation, or incident response planning. Backups are a last line of defense, not a primary prevention control.\n\n## Prerequisites\n\n- Inventory of critical systems, applications, and data classified by business impact (Tier 1\u002F2\u002F3)\n- Defined RPO (Recovery Point Objective) and RTO (Recovery Time Objective) per tier\n- Backup software supporting immutable repositories (Veeam 12+, Commvault, Rubrik, Cohesity)\n- Isolated backup network segment or air-gapped storage infrastructure\n- Separate backup admin credentials not joined to the production AD domain\n\n## Workflow\n\n### Step 1: Classify Assets and Define Recovery Objectives\n\nMap all systems into recovery tiers based on business impact:\n\n| Tier | Examples | RPO | RTO | Backup Frequency |\n|------|----------|-----|-----|------------------|\n| Tier 1 (Critical) | Domain controllers, ERP, databases | 1 hour | 4 hours | Hourly incremental, daily full |\n| Tier 2 (Important) | File servers, email, web apps | 4 hours | 12 hours | Every 4 hours incremental, daily full |\n| Tier 3 (Standard) | Dev environments, archives | 24 hours | 48 hours | Daily incremental, weekly full |\n\nDocument dependencies between systems. Domain controllers and DNS must recover before application servers. Database servers before application tiers.\n\n### Step 2: Implement 3-2-1-1-0 Architecture\n\nConfigure backup storage following the extended 3-2-1-1-0 rule:\n\n**Copy 1 - Primary backup on local storage:**\n```\n# Veeam backup job targeting local repository\n# Fast restore for operational recovery\nBackup Repository: Local NAS (CIFS\u002FNFS) or SAN\nRetention: 14 days of restore points\nEncryption: AES-256 with password not stored in AD\n```\n\n**Copy 2 - Secondary backup on different media:**\n```\n# Replicate to secondary site or cloud\n# Veeam Backup Copy Job or Scale-Out Backup Repository\nTarget: AWS S3 \u002F Azure Blob \u002F Wasabi \u002F tape library\nRetention: 30 days\nTransfer: Encrypted TLS 1.2+ in transit\n```\n\n**Copy 3 - Offsite copy:**\n```\n# Geographically separated from primary and secondary\n# Cloud object storage in different region or physical tape rotation\nTarget: Cross-region cloud storage or Iron Mountain tape vaulting\nRetention: 90 days\n```\n\n**+1 - Immutable or air-gapped copy:**\n```\n# Cannot be modified or deleted for defined retention period\n# Veeam Hardened Repository on Linux with immutable flag\n# Or AWS S3 Object Lock in Compliance mode\n# Or physical air-gapped tape\n```\n\n**+0 - Zero errors on restore verification:**\n```\n# Automated restore testing using Veeam SureBackup or equivalent\n# Scheduled weekly for Tier 1, monthly for Tier 2\u002F3\n# Verify boot, network connectivity, and application health\n```\n\n### Step 3: Isolate Backup Credentials\n\nRansomware operators target backup infrastructure by compromising backup admin credentials through Active Directory:\n\n1. **Separate backup admin accounts** from the production AD domain. Use local accounts on backup servers or a dedicated backup management domain.\n2. **Dedicated backup network segment** with firewall rules allowing only backup traffic (specific ports, specific source\u002Fdestination IPs).\n3. **MFA on backup console access** using hardware tokens or authenticator apps, not SMS.\n4. **Disable RDP** on backup servers. Use out-of-band management (iLO\u002FiDRAC\u002FIPMI) for emergency access.\n5. **Remove backup servers from domain** or place in a dedicated OU with restricted GPO inheritance.\n\n```bash\n# Linux Hardened Repository - disable SSH password auth\nsudo sed -i 's\u002FPasswordAuthentication yes\u002FPasswordAuthentication no\u002F' \u002Fetc\u002Fssh\u002Fsshd_config\nsudo systemctl restart sshd\n\n# Set immutable flag on backup files (XFS filesystem)\nsudo chattr +i \u002Fmnt\u002Fbackup\u002Frepository\u002F*\n\n# Veeam Hardened Repository uses single-use credentials\n# that are not stored on the Veeam server after initial setup\n```\n\n### Step 4: Configure Immutable Storage\n\n**Veeam Hardened Linux Repository:**\n```bash\n# Minimal Ubuntu 22.04 LTS installation\n# No GUI, no unnecessary services\n# Veeam uses temporary SSH credentials during backup window only\n\n# Configure XFS with reflink support\nsudo mkfs.xfs -b size=4096 -m reflink=1 \u002Fdev\u002Fsdb1\nsudo mount \u002Fdev\u002Fsdb1 \u002Fmnt\u002Fveeam-repo\n\n# Create dedicated Veeam user with limited permissions\nsudo useradd -m -s \u002Fbin\u002Fbash veeamuser\nsudo mkdir -p \u002Fmnt\u002Fveeam-repo\u002Fbackups\nsudo chown veeamuser:veeamuser \u002Fmnt\u002Fveeam-repo\u002Fbackups\n```\n\n**AWS S3 Object Lock (Compliance Mode):**\n```bash\n# Create bucket with Object Lock enabled\naws s3api create-bucket \\\n  --bucket company-immutable-backups \\\n  --object-lock-enabled-for-bucket \\\n  --region us-east-1\n\n# Set default retention - 30 days compliance mode\naws s3api put-object-lock-configuration \\\n  --bucket company-immutable-backups \\\n  --object-lock-configuration '{\n    \"ObjectLockEnabled\": \"Enabled\",\n    \"Rule\": {\n      \"DefaultRetention\": {\n        \"Mode\": \"COMPLIANCE\",\n        \"Days\": 30\n      }\n    }\n  }'\n```\n\n**Azure Immutable Blob Storage:**\n```bash\n# Create storage account with immutable storage\naz storage container immutability-policy create \\\n  --account-name backupaccount \\\n  --container-name immutable-backups \\\n  --period 30\n\n# Lock the policy (irreversible)\naz storage container immutability-policy lock \\\n  --account-name backupaccount \\\n  --container-name immutable-backups\n```\n\n### Step 5: Automate Restore Testing\n\nConfigure automated restore verification on a recurring schedule:\n\n```powershell\n# Veeam SureBackup verification job (PowerShell)\n# Tests VM boot, network ping, and application health\n\nAdd-PSSnapin VeeamPSSnapin\n$backupJob = Get-VBRJob -Name \"Tier1-DailyBackup\"\n$sureBackupJob = Get-VSBJob -Name \"Tier1-RestoreTest\"\n\n# Verify last restore test completed successfully\n$lastSession = Get-VSBSession -Job $sureBackupJob -Last\nif ($lastSession.Result -ne \"Success\") {\n    Send-MailMessage -To \"backup-team@company.com\" `\n        -Subject \"ALERT: SureBackup verification failed\" `\n        -Body \"Tier 1 restore test failed. Last result: $($lastSession.Result)\" `\n        -SmtpServer \"smtp.company.com\"\n}\n```\n\nDocument restore test results and maintain a recovery runbook with step-by-step procedures for each tier.\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **3-2-1-1-0** | Extended backup rule: 3 copies, 2 media types, 1 offsite, 1 immutable\u002Fair-gapped, 0 restore verification errors |\n| **RPO** | Recovery Point Objective: maximum acceptable data loss measured in time (e.g., 1 hour RPO means max 1 hour of data loss) |\n| **RTO** | Recovery Time Objective: maximum acceptable downtime before system must be operational |\n| **Immutable Backup** | Backup copy that cannot be modified, encrypted, or deleted for a defined retention period, even by administrators |\n| **Air-Gapped Backup** | Physically isolated backup with no network connectivity to production systems, providing strongest ransomware protection |\n| **Hardened Repository** | Linux-based backup storage with minimal attack surface, no persistent SSH, and immutable file flags |\n\n## Tools & Systems\n\n- **Veeam Backup & Replication 12**: Enterprise backup with Hardened Linux Repository, SureBackup verification, and immutable backup support\n- **Rubrik Security Cloud**: Zero-trust backup platform with immutable snapshots, anomaly detection, and air-gapped recovery\n- **Commvault**: Backup with Metallic air-gap protection, anomaly detection, and automated recovery orchestration\n- **AWS S3 Object Lock**: Cloud-native immutable storage in Compliance or Governance mode for backup copies\n- **Cohesity DataProtect**: Backup platform with DataLock immutability, anti-ransomware detection, and instant mass restore\n\n## Common Scenarios\n\n### Scenario: Financial Services Firm Implementing Ransomware-Resilient Backup\n\n**Context**: A mid-size bank with 500 servers, 200TB of data, and regulatory requirements for 7-year retention must redesign backup after a peer institution was hit by ransomware. Current backups use a single Veeam repository on a Windows server joined to the production domain.\n\n**Approach**:\n1. Classify all 500 servers into three tiers: 50 Tier 1 (core banking, AD, DNS), 200 Tier 2 (email, file shares, web), 250 Tier 3 (dev, test, archive)\n2. Deploy Veeam Hardened Linux Repository on dedicated Ubuntu 22.04 servers with XFS immutability for primary backup\n3. Configure S3 Object Lock in Compliance mode for 30-day immutable cloud copy with Veeam Scale-Out Repository capacity tier\n4. Establish quarterly tape rotation to Iron Mountain for 7-year regulatory retention\n5. Remove all backup servers from the production AD domain and create isolated backup admin accounts with hardware MFA tokens\n6. Deploy SureBackup jobs: weekly for Tier 1, monthly for Tier 2, quarterly for Tier 3\n7. Conduct annual full recovery drill restoring AD, DNS, core banking, and dependent applications to validate documented RTO\n\n**Pitfalls**:\n- Leaving backup admin credentials in the production AD domain where ransomware operators can compromise them via Kerberoasting or DCSync\n- Configuring immutable retention periods shorter than the dwell time of typical ransomware (average 21 days), allowing attackers to wait for immutability to expire\n- Testing only individual VM restores without testing full application stack recovery including dependencies\n- Forgetting to back up backup server configuration (Veeam config database, encryption keys) separately from the backup infrastructure itself\n\n## Output Format\n\n```\n## Ransomware Backup Strategy Assessment\n\n**Organization**: [Name]\n**Assessment Date**: [Date]\n**Assessor**: [Name]\n\n### Current State\n- Backup Solution: [Product\u002FVersion]\n- Copies: [Number and locations]\n- Immutable Copy: [Yes\u002FNo - Details]\n- Air-Gapped Copy: [Yes\u002FNo - Details]\n- Credential Isolation: [Yes\u002FNo - Details]\n- Last Restore Test: [Date - Result]\n\n### Gap Analysis\n| Control | Current | Target | Gap | Priority |\n|---------|---------|--------|-----|----------|\n| Immutable backup | None | S3 Object Lock + Linux Hardened Repo | Missing | Critical |\n| Credential isolation | Domain-joined | Standalone local accounts + MFA | Partial | Critical |\n| Restore testing | Ad-hoc manual | Automated weekly SureBackup | Missing | High |\n\n### Recommendations\n1. [Priority] [Recommendation] - [Estimated effort]\n2. ...\n\n### Recovery Tier Summary\n| Tier | Systems | RPO | RTO | Backup Schedule | Restore Test Frequency |\n|------|---------|-----|-----|-----------------|----------------------|\n| 1 | 50 | 1hr | 4hr | Hourly inc\u002FDaily full | Weekly |\n| 2 | 200 | 4hr | 12hr | 4hr inc\u002FDaily full | Monthly |\n| 3 | 250 | 24hr | 48hr | Daily inc\u002FWeekly full | Quarterly |\n```\n","# Implementing Ransomware Backup Strategy\n\n## When to Use\n\n- Designing backup architecture that withstands ransomware encryption and deletion attempts\n- Migrating from traditional backup to ransomware-resilient backup with immutable storage\n- Establishing RPO\u002FRTO targets for critical systems and validating them through restore testing\n- Isolating backup credentials and infrastructure from the production Active Directory domain\n- Meeting cyber insurance requirements for backup resilience and tested recovery capabilities\n\n**Do not use** as a substitute for endpoint protection, network segmentation, or incident response planning. Backups are a last line of defense, not a primary prevention control.\n\n## Prerequisites\n\n- Inventory of critical systems, applications, and data classified by business impact (Tier 1\u002F2\u002F3)\n- Defined RPO (Recovery Point Objective) and RTO (Recovery Time Objective) per tier\n- Backup software supporting immutable repositories (Veeam 12+, Commvault, Rubrik, Cohesity)\n- Isolated backup network segment or air-gapped storage infrastructure\n- Separate backup admin credentials not joined to the production AD domain\n\n## Workflow\n\n### Step 1: Classify Assets and Define Recovery Objectives\n\nMap all systems into recovery tiers based on business impact:\n\n| Tier | Examples | RPO | RTO | Backup Frequency |\n|------|----------|-----|-----|------------------|\n| Tier 1 (Critical) | Domain controllers, ERP, databases | 1 hour | 4 hours | Hourly incremental, daily full |\n| Tier 2 (Important) | File servers, email, web apps | 4 hours | 12 hours | Every 4 hours incremental, daily full |\n| Tier 3 (Standard) | Dev environments, archives | 24 hours | 48 hours | Daily incremental, weekly full |\n\nDocument dependencies between systems. Domain controllers and DNS must recover before application servers. Database servers before application tiers.\n\n### Step 2: Implement 3-2-1-1-0 Architecture\n\nConfigure backup storage following the extended 3-2-1-1-0 rule:\n\n**Copy 1 - Primary backup on local storage:**\n```\n# Veeam backup job targeting local repository\n# Fast restore for operational recovery\nBackup Repository: Local NAS (CIFS\u002FNFS) or SAN\nRetention: 14 days of restore points\nEncryption: AES-256 with password not stored in AD\n```\n\n**Copy 2 - Secondary backup on different media:**\n```\n# Replicate to secondary site or cloud\n# Veeam Backup Copy Job or Scale-Out Backup Repository\nTarget: AWS S3 \u002F Azure Blob \u002F Wasabi \u002F tape library\nRetention: 30 days\nTransfer: Encrypted TLS 1.2+ in transit\n```\n\n**Copy 3 - Offsite copy:**\n```\n# Geographically separated from primary and secondary\n# Cloud object storage in different region or physical tape rotation\nTarget: Cross-region cloud storage or Iron Mountain tape vaulting\nRetention: 90 days\n```\n\n**+1 - Immutable or air-gapped copy:**\n```\n# Cannot be modified or deleted for defined retention period\n# Veeam Hardened Repository on Linux with immutable flag\n# Or AWS S3 Object Lock in Compliance mode\n# Or physical air-gapped tape\n```\n\n**+0 - Zero errors on restore verification:**\n```\n# Automated restore testing using Veeam SureBackup or equivalent\n# Scheduled weekly for Tier 1, monthly for Tier 2\u002F3\n# Verify boot, network connectivity, and application health\n```\n\n### Step 3: Isolate Backup Credentials\n\nRansomware operators target backup infrastructure by compromising backup admin credentials through Active Directory:\n\n1. **Separate backup admin accounts** from the production AD domain. Use local accounts on backup servers or a dedicated backup management domain.\n2. **Dedicated backup network segment** with firewall rules allowing only backup traffic (specific ports, specific source\u002Fdestination IPs).\n3. **MFA on backup console access** using hardware tokens or authenticator apps, not SMS.\n4. **Disable RDP** on backup servers. Use out-of-band management (iLO\u002FiDRAC\u002FIPMI) for emergency access.\n5. **Remove backup servers from domain** or place in a dedicated OU with restricted GPO inheritance.\n\n```bash\n# Linux Hardened Repository - disable SSH password auth\nsudo sed -i 's\u002FPasswordAuthentication yes\u002FPasswordAuthentication no\u002F' \u002Fetc\u002Fssh\u002Fsshd_config\nsudo systemctl restart sshd\n\n# Set immutable flag on backup files (XFS filesystem)\nsudo chattr +i \u002Fmnt\u002Fbackup\u002Frepository\u002F*\n\n# Veeam Hardened Repository uses single-use credentials\n# that are not stored on the Veeam server after initial setup\n```\n\n### Step 4: Configure Immutable Storage\n\n**Veeam Hardened Linux Repository:**\n```bash\n# Minimal Ubuntu 22.04 LTS installation\n# No GUI, no unnecessary services\n# Veeam uses temporary SSH credentials during backup window only\n\n# Configure XFS with reflink support\nsudo mkfs.xfs -b size=4096 -m reflink=1 \u002Fdev\u002Fsdb1\nsudo mount \u002Fdev\u002Fsdb1 \u002Fmnt\u002Fveeam-repo\n\n# Create dedicated Veeam user with limited permissions\nsudo useradd -m -s \u002Fbin\u002Fbash veeamuser\nsudo mkdir -p \u002Fmnt\u002Fveeam-repo\u002Fbackups\nsudo chown veeamuser:veeamuser \u002Fmnt\u002Fveeam-repo\u002Fbackups\n```\n\n**AWS S3 Object Lock (Compliance Mode):**\n```bash\n# Create bucket with Object Lock enabled\naws s3api create-bucket \\\n  --bucket company-immutable-backups \\\n  --object-lock-enabled-for-bucket \\\n  --region us-east-1\n\n# Set default retention - 30 days compliance mode\naws s3api put-object-lock-configuration \\\n  --bucket company-immutable-backups \\\n  --object-lock-configuration '{\n    \"ObjectLockEnabled\": \"Enabled\",\n    \"Rule\": {\n      \"DefaultRetention\": {\n        \"Mode\": \"COMPLIANCE\",\n        \"Days\": 30\n      }\n    }\n  }'\n```\n\n**Azure Immutable Blob Storage:**\n```bash\n# Create storage account with immutable storage\naz storage container immutability-policy create \\\n  --account-name backupaccount \\\n  --container-name immutable-backups \\\n  --period 30\n\n# Lock the policy (irreversible)\naz storage container immutability-policy lock \\\n  --account-name backupaccount \\\n  --container-name immutable-backups\n```\n\n### Step 5: Automate Restore Testing\n\nConfigure automated restore verification on a recurring schedule:\n\n```powershell\n# Veeam SureBackup verification job (PowerShell)\n# Tests VM boot, network ping, and application health\n\nAdd-PSSnapin VeeamPSSnapin\n$backupJob = Get-VBRJob -Name \"Tier1-DailyBackup\"\n$sureBackupJob = Get-VSBJob -Name \"Tier1-RestoreTest\"\n\n# Verify last restore test completed successfully\n$lastSession = Get-VSBSession -Job $sureBackupJob -Last\nif ($lastSession.Result -ne \"Success\") {\n    Send-MailMessage -To \"backup-team@company.com\" `\n        -Subject \"ALERT: SureBackup verification failed\" `\n        -Body \"Tier 1 restore test failed. Last result: $($lastSession.Result)\" `\n        -SmtpServer \"smtp.company.com\"\n}\n```\n\nDocument restore test results and maintain a recovery runbook with step-by-step procedures for each tier.\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **3-2-1-1-0** | Extended backup rule: 3 copies, 2 media types, 1 offsite, 1 immutable\u002Fair-gapped, 0 restore verification errors |\n| **RPO** | Recovery Point Objective: maximum acceptable data loss measured in time (e.g., 1 hour RPO means max 1 hour of data loss) |\n| **RTO** | Recovery Time Objective: maximum acceptable downtime before system must be operational |\n| **Immutable Backup** | Backup copy that cannot be modified, encrypted, or deleted for a defined retention period, even by administrators |\n| **Air-Gapped Backup** | Physically isolated backup with no network connectivity to production systems, providing strongest ransomware protection |\n| **Hardened Repository** | Linux-based backup storage with minimal attack surface, no persistent SSH, and immutable file flags |\n\n## Tools & Systems\n\n- **Veeam Backup & Replication 12**: Enterprise backup with Hardened Linux Repository, SureBackup verification, and immutable backup support\n- **Rubrik Security Cloud**: Zero-trust backup platform with immutable snapshots, anomaly detection, and air-gapped recovery\n- **Commvault**: Backup with Metallic air-gap protection, anomaly detection, and automated recovery orchestration\n- **AWS S3 Object Lock**: Cloud-native immutable storage in Compliance or Governance mode for backup copies\n- **Cohesity DataProtect**: Backup platform with DataLock immutability, anti-ransomware detection, and instant mass restore\n\n## Common Scenarios\n\n### Scenario: Financial Services Firm Implementing Ransomware-Resilient Backup\n\n**Context**: A mid-size bank with 500 servers, 200TB of data, and regulatory requirements for 7-year retention must redesign backup after a peer institution was hit by ransomware. Current backups use a single Veeam repository on a Windows server joined to the production domain.\n\n**Approach**:\n1. Classify all 500 servers into three tiers: 50 Tier 1 (core banking, AD, DNS), 200 Tier 2 (email, file shares, web), 250 Tier 3 (dev, test, archive)\n2. Deploy Veeam Hardened Linux Repository on dedicated Ubuntu 22.04 servers with XFS immutability for primary backup\n3. Configure S3 Object Lock in Compliance mode for 30-day immutable cloud copy with Veeam Scale-Out Repository capacity tier\n4. Establish quarterly tape rotation to Iron Mountain for 7-year regulatory retention\n5. Remove all backup servers from the production AD domain and create isolated backup admin accounts with hardware MFA tokens\n6. Deploy SureBackup jobs: weekly for Tier 1, monthly for Tier 2, quarterly for Tier 3\n7. Conduct annual full recovery drill restoring AD, DNS, core banking, and dependent applications to validate documented RTO\n\n**Pitfalls**:\n- Leaving backup admin credentials in the production AD domain where ransomware operators can compromise them via Kerberoasting or DCSync\n- Configuring immutable retention periods shorter than the dwell time of typical ransomware (average 21 days), allowing attackers to wait for immutability to expire\n- Testing only individual VM restores without testing full application stack recovery including dependencies\n- Forgetting to back up backup server configuration (Veeam config database, encryption keys) separately from the backup infrastructure itself\n\n## Output Format\n\n```\n## Ransomware Backup Strategy Assessment\n\n**Organization**: [Name]\n**Assessment Date**: [Date]\n**Assessor**: [Name]\n\n### Current State\n- Backup Solution: [Product\u002FVersion]\n- Copies: [Number and locations]\n- Immutable Copy: [Yes\u002FNo - Details]\n- Air-Gapped Copy: [Yes\u002FNo - Details]\n- Credential Isolation: [Yes\u002FNo - Details]\n- Last Restore Test: [Date - Result]\n\n### Gap Analysis\n| Control | Current | Target | Gap | Priority |\n|---------|---------|--------|-----|----------|\n| Immutable backup | None | S3 Object Lock + Linux Hardened Repo | Missing | Critical |\n| Credential isolation | Domain-joined | Standalone local accounts + MFA | Partial | Critical |\n| Restore testing | Ad-hoc manual | Automated weekly SureBackup | Missing | High |\n\n### Recommendations\n1. [Priority] [Recommendation] - [Estimated effort]\n2. ...\n\n### Recovery Tier Summary\n| Tier | Systems | RPO | RTO | Backup Schedule | Restore Test Frequency |\n|------|---------|-----|-----|-----------------|----------------------|\n| 1 | 50 | 1hr | 4hr | Hourly inc\u002FDaily full | Weekly |\n| 2 | 200 | 4hr | 12hr | 4hr inc\u002FDaily full | Monthly |\n| 3 | 250 | 24hr | 48hr | Daily inc\u002FWeekly full | Quarterly |\n```\n",{"name":5,"tags":52,"author":53,"domain":46,"license":15,"version":54,"mitre_f3":55,"nist_csf":75,"subdomain":80,"description":81,"nist_ai_rmf":82,"mitre_attack":88,"atlas_techniques":94},[29,28,40,37,32,31],"mahipal","1.0.0",{"tactics":56,"version":59,"techniques":60},[57,58],"positioning","monetization","1.1",[61,65,69,72],{"id":62,"name":63,"source":64,"tactic":57},"T1531","Account Access Removal","attack",{"id":66,"name":67,"source":68,"tactic":58},"F1018","Convert to Cryptocurrency","f3",{"id":70,"name":71,"source":68,"tactic":58},"F1047","Transfer of funds",{"id":73,"name":74,"source":68,"tactic":58},"F1017.001","Conversion to Physical Monetary Instruments: Cash",[76,77,78,79],"PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01","ransomware-defense","Designs a ransomware-resilient backup strategy using the 3-2-1-1-0 methodology (3 copies, 2 media types, 1 offsite, 1 immutable\u002Fair-gapped, 0 restore errors), configuring RPO\u002FRTO-aligned schedules, isolating backup credentials, and automating restore testing. Use when planning ransomware backup resilience or air-gapped\u002Fimmutable backup architecture.\n",[83,84,85,86,87],"MEASURE-2.7","MAP-5.1","MANAGE-2.4","MANAGE-3.1","MEASURE-3.1",[89,90,91,92,93],"T1078","T1190","T1059","T1003","T1110",[95,96,97],"AML.T0070","AML.T0066","AML.T0082","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-ransomware-backup-strategy",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":109,"prompt":119,"zipAvailable":120},[110,113,116],{"tool":111,"command":112},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-ransomware-backup-strategy",{"tool":114,"command":115},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-ransomware-backup-strategy",{"tool":117,"command":118},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-ransomware-backup-strategy","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ransomware-backup-strategy\u002FSKILL.md",true,[122,128,133,139,143,147,153],{"path":123,"resourceType":124,"resourceTypeDesc":125,"sizeBytes":126,"sourceHtmlUrl":127},"assets\u002Ftemplate.md","ASSET","资产文件",3794,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ransomware-backup-strategy\u002Fassets\u002Ftemplate.md",{"path":129,"resourceType":129,"resourceTypeDesc":130,"sizeBytes":131,"sourceHtmlUrl":132},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ransomware-backup-strategy\u002FLICENSE",{"path":134,"resourceType":135,"resourceTypeDesc":136,"sizeBytes":137,"sourceHtmlUrl":138},"references\u002Fapi-reference.md","REFERENCE","参考文档",6613,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ransomware-backup-strategy\u002Freferences\u002Fapi-reference.md",{"path":140,"resourceType":135,"resourceTypeDesc":136,"sizeBytes":141,"sourceHtmlUrl":142},"references\u002Fstandards.md",2516,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ransomware-backup-strategy\u002Freferences\u002Fstandards.md",{"path":144,"resourceType":135,"resourceTypeDesc":136,"sizeBytes":145,"sourceHtmlUrl":146},"references\u002Fworkflows.md",3741,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ransomware-backup-strategy\u002Freferences\u002Fworkflows.md",{"path":148,"resourceType":149,"resourceTypeDesc":150,"sizeBytes":151,"sourceHtmlUrl":152},"scripts\u002Fagent.py","SCRIPT","脚本",12072,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ransomware-backup-strategy\u002Fscripts\u002Fagent.py",{"path":154,"resourceType":149,"resourceTypeDesc":150,"sizeBytes":155,"sourceHtmlUrl":156},"scripts\u002Fprocess.py",22852,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ransomware-backup-strategy\u002Fscripts\u002Fprocess.py",[158,184,208,226,252,278],{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":165,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[164],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[166,167,168,169,170,46,171,172,42,173,174,175,176,177,178,179,180,181,182,183],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":191,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[190],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[192,180,193,194,170,195,46,42,196,197,198,199,200,201,202,203,204,205,206,207],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":209,"name":210,"nameZh":6,"description":211,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":212,"categories":213,"keywords":216,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[214,215],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[202,28,32,217,38,46,218,219,196,220,221,40,29,39,222,35,223,33,224,225],"validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","detection","t1490","disaster-recovery","restore-testing",{"skillNo":227,"name":228,"nameZh":6,"description":229,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":230,"categories":231,"keywords":233,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[232],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[234,235,236,46,237,238,239,240,241,242,243,244,245,246,247,248,199,249,250,251],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":253,"name":254,"nameZh":6,"description":255,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":256,"categories":257,"keywords":259,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[258],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[260,261,262,46,263,41,264,265,266,267,268,269,270,271,272,273,274,275,276,277],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":279,"name":280,"nameZh":6,"description":281,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":282,"categories":283,"keywords":285,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[284],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[170,286,46,287,288,289,290,291,292,293,294,35,295,223,296,297,298,299,300,301],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]