Restore engineering and control systems when the backup server is encrypted
When a destructive attack reaches your network, it does not stop at the production systems. It reaches the recovery systems too, because anything the network can touch is in scope, including the server you were counting on to bring everything back. In the Jaguar Land Rover incident, manufacturing across three countries stayed down for roughly five weeks, the estimated cost ran to about 1.9 billion pounds, and more than five thousand businesses in the supply chain felt it. The lesson that keeps repeating in industrial recovery is plain. If your last copy lives somewhere an attacker can reach, you do not really have a last copy.
For an operations team the clock is unforgiving. Every hour that engineering workstations, controllers and project files stay down is an hour of lost production, missed safety windows and contractual exposure. The recovery plan that looks complete on paper falls apart the moment the restore source is found encrypted alongside everything else.
Software based protection assumes the attacker can be held off by permissions, by immutability flags or by network segmentation. Each of those still runs on a control plane that the network can reach, which means each of them can be targeted by an intruder who already holds domain admin. Making data hard to change is not the same as making it impossible to reach. For a detailed look at what an intruder holding admin credentials can still do, see can immutable backups be deleted.
A physically isolated recovery vault changes the model. Data moves into it across a one way path, so there is no route back in from the production side and nothing for an attacker to alter or destroy. There is no software attack surface to defeat, because the connection itself is removed rather than guarded. When your primary environment is down, the isolated copy is untouched, and it becomes the last resort source that brings engineering and control systems back. Eleven units are already in service across five countries. For a plain-language breakdown of how immutability, network isolation and physical disconnect differ, see the three layers of recovery assurance.
Here is a test you can run without us. Ask your IT team to walk through a full recovery on the assumption that domain admin credentials are gone and the restore server itself is encrypted. If they can bring the line back in under four hours, you are in good shape and you do not need us. If they cannot, that gap is exactly what we close.
Related
HyperBUNKER's physically isolated approach has been independently covered by Blocks & Files and TechRadar.
The same exposure sits one layer down in the engineering stack, because the project files that define your control logic can be encrypted along with everything else. See how to keep SCADA project files recoverable.
If you want the layer-by-layer version of why the recovery copy was reachable in the first place, we set it out in the three layers of recovery assurance, and we answer the specific question of whether immutable backups can be deleted on its own page.