Unit 11: Backups and recovery · Lesson 1 of 4 · 20 min
Case file: a backup job that backs nothing up
A factory group stopped production for weeks after an attack. Check whether web01 could come back at all.
mission
- You are
- You are reviewing web01's backups.
- Situation
- The handover says a nightly job copies the web root to backup01, and a backup plan lives in /srv/backup/plan.yaml.
- Goal
- Prove what the job really does and score the plan against 3-2-1.
- Hand in
- Findings on the job and on each copy.
case file
Jaguar Land Rover Production Shutdown
Jaguar Land Rover · 2025
Jaguar Land Rover shut down its network on August 31, 2025 after detecting attackers, halting vehicle production for several weeks; a group calling itself Scattered Lapsus$ Hunters claimed responsibility and JLR later confirmed data was taken. On September 29, 2025, the UK government approved a GBP 1.5 billion loan guarantee to support JLR and its supply chain, which employs about 120,000 people. JLR reported the incident cost GBP 196 million in its July-September quarter and restarted production in phases from early October.
What went wrong
Not publicly confirmed (uncertain). The documented lesson is resilience: tightly coupled IT and manufacturing systems meant a containment shutdown stopped production and cascaded to suppliers.
What would have stopped it
- Segment manufacturing/OT systems from corporate IT so containment of an IT intrusion does not require stopping production.
- Maintain tested recovery plans and immutable backups with realistic restore-time objectives for production-critical systems.
- Assess supplier dependency and financial resilience as part of business continuity planning.
- Harden help desk and identity processes against social engineering, a known tactic of the claiming group (uncertain whether used here).
What defenders could have seen
- Unexpected privileged account activity or new remote access tooling in corporate IT.
- Alerts on mass access to file shares or data staging prior to exfiltration.
What does the nightly job run?
grep -E '^(Description|ExecStart)' /etc/systemd/system/backup.service Description=Nightly copy of the web root to backup01 ExecStart=/opt/scripts/report.sh cat /opt/scripts/report.sh #!/bin/bash df -h / > /tmp/disk-report.txt
you should see A job called backup that only writes a disk report.
Read the plan
cat /srv/backup/plan.yaml
service: web01 web root and app config
copies:
- name: local-restic
where: /srv/backup on web01
same_host: yes
writable_by: root on web01
- name: nas01
where: nas01.internal:/backups/web01
same_host: no
same_network: yes
writable_by: backup user on web01
- name: cloud-bucket
where: s3://shop-backups-web01
same_host: no
offsite: yes
object_lock: disabled
writable_by: backup user on web01
last_restore_test: never
you should see Three copies on paper.
Score it
Ask of each copy: could the same attacker reach it, change it or delete it?
grep -E 'name|same_host|same_network|object_lock|writable_by|last_restore' /srv/backup/plan.yaml
- name: local-restic
same_host: yes
writable_by: root on web01
- name: nas01
same_host: no
same_network: yes
writable_by: backup user on web01
- name: cloud-bucket
same_host: no
object_lock: disabled
writable_by: backup user on web01
last_restore_test: never
you should see Every copy is writable from web01, the offsite one has no object lock, and no restore was ever tested.
defender tip An attacker with root on web01 can delete every copy this plan lists. One copy must be unreachable or immutable.
3-2-1
3 copies all writable from web01 no object lock last_restore_test: never
Counts as three, survives as zero
3 copies, 2 media, 1 offsite offsite with object lock pull-based, not pushed from web01 restore tested monthly
One copy survives anything web01 can do
What a defender takes away
- 1Read what a backup job runs, not what it is called.
- 2At least one copy must be immutable or offline.
- 3An untested backup is a hope, not a plan.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.