It's not just a matter of backup and restore processes
Just because data can be restored doesn't mean that it's that simple. Restoring data onto a compromised system is a bit pointless. How do you know the systems are no longer compromised? You rebuild them from scratch, that's how. That's slow and fraught with potential problems. The least of the problems is rebuilding the data from a backup. User credentials may need to be reset, databases recreated, users needing to be alerted.
The important thing is to find how the breach occurred and patch whatever it was if it was a vulnerability, or if it's through an email, finding how it happened so it doesn't happen the same way again. This is why penetration testing, user education, anti-phishing training and better email security are all key.
These days, the perpetrators of this ransomware stuff are really clever and it's not just a matter of one PC and a few thousand files. As the article says, the backups may be poisoned too.
Bulking up security and better backups are just part of the equation. Tracking these thugs is the other part. Governments which obstruct efforts to find the crims should be sanctioned in much the same way as unruly potential nuclear powers are. And governments which fund these activities (we're looking at you, Norks) need to be even more heavily sanctioned until they start to behave.
Biting the hand that feeds IT
