Immutable and isolated copies
Copies an attacker with administrative credentials cannot alter or delete, held where the production identity system has no authority.
Research program
Recovery as a first-class discipline
Prevention attracts budget and attention. Recovery is usually delegated to infrastructure, measured by job success, and rehearsed rarely. This program studies whether recovery capability is systematically underinvested relative to its effect on total loss.
What is the shortest honest path from a destructive event back to validated operation?
The core distinction
Claim: observation
A successful backup job is not evidence of recoverability. A successful restore is. The two are frequently conflated in reporting, and the difference only becomes visible during the worst week the organisation will have.
Restores fail for ordinary reasons: the backup captured the data but not the configuration, the recovery environment depends on the systems that are down, the credentials needed to restore were stored in the system being restored, or the restore works but takes four days when the business assumed four hours.
Capabilities under study
Claim: recommendation
Recovery has several parts. Each fails in its own way and needs its own test.
Clean-room rebuild
The ability to construct a trusted environment when the existing one must be assumed compromised, including the identity layer.
Credential reset at scale
Rotating every credential, key, token, and service account quickly, which is rehearsed almost nowhere and required in most serious intrusions.
Degraded-mode operation
Running the essential part of the business without the systems that are down, specified in advance rather than improvised.
Dependency recovery
Knowing which third parties must recover before you can, and whether their timelines are compatible with yours.
Recovery communications
What is said to customers, regulators, staff, and partners, with the decision owners named before the event.
The hypothesis about underinvestment
Claim: hypothesis
The claim is that recovery testing predicts readiness for destructive attacks better than backup configuration does, and that budget allocation does not reflect this. Both halves need evidence: the predictive claim from incident outcome data, the allocation claim from spending patterns.
What would prove us wrong?
Claim: unknown
The program assumes recovery capability is underweighted relative to prevention.
- Outcome data showing that organisations with strong prevention rarely reach the point where recovery capability determines the loss.
- Evidence that recovery drills at meaningful scale cost more in disruption than the expected loss they mitigate.
- Cases where backup configuration quality alone predicted successful recovery as well as rehearsed restores did.
Experiments for this program
- Timed restore into a clean environment What is the demonstrated recovery time and data loss for a critical system?
- Bounded credential rotation Could the organisation rotate every secret of one class quickly if it had to?
Patterns and anti-patterns
- Publish the demonstrated result beside the target (pattern)
- Reporting backup job success as recoverability (anti-pattern)
Evidence for this program
- NIST SP 800-34, contingency planning guide Establishes recovery objectives as planning targets. This area asks for the demonstrated result beside the target.
- CISA Stop Ransomware guidance Practical recovery material, including isolated backup guidance used in the restore experiments.
Research notes
Credential reset at scale is required and almost never rehearsed
Serious intrusions usually end with rotating every credential, key, token, certificate, and service account. Most organisations have never attempted this even partially. Full rotation is disruptive, which is why it is skipped, but a bounded drill on one class of secret shows what breaks before an intrusion forces the issue.
The restore worked and took four days
A restore can return all the data and still come too late. Time, sequence, and hidden dependencies often cause the loss. Restore order, recovery credentials, network capacity, and staff availability do not appear in a backup report, but all of them appear in a timed drill.