A business can make ransomware far more devastating by keeping its backups reachable from the same systems an attacker can compromise—and never testing whether those backups can restore operations. That is not the only way ransomware succeeds, and no single control guarantees safety. But offline, encrypted backups that are regularly tested are a core part of a recovery plan.
What mistake makes ransomware harder to recover from?
The practical failure is treating backup completion as proof of recoverability. If backup copies remain continuously accessible to compromised accounts or systems, attackers may be able to delete or encrypt them. If nobody has tested a restoration, the organization may discover during an incident that its copies are incomplete, unusable, or too slow to restore.
As an Amazon Associate I earn from qualifying purchases.
CISA’s interagency #StopRansomware Guide defines the threat this way: “Ransomware is a form of malware designed to encrypt files on a device, rendering them and the systems that rely on them unusable.” Extortion may also involve stolen data and threats to disclose it, so restoring files may not resolve every consequence of an attack.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11CISA recommends keeping critical data backups offline and encrypted, then regularly testing their availability and integrity. A disconnected encrypted external drive can be one part of that approach, but a drive by itself is not a backup plan: it must be separated from live systems and accounts attackers could control, and the business needs a tested way to restore from it.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
How do you know whether your backups are recoverable?
Judge the backup process by whether the business can restore the services it needs, not just whether a backup job reports success. Work through these checks:
- Coverage: Identify critical data, applications, and systems, and confirm they are included in backups.
- Isolation: Determine whether an attacker using a compromised account or system could reach, alter, delete, or encrypt each backup copy. Keep at least one critical copy offline.
- Encryption and access: Protect backup data with encryption and restrict access to people and systems that need it.
- Restore tests: Regularly restore data and systems in a controlled test. Confirm that the restored copies are intact and that staff know the steps.
- Operational priorities: Decide which services must return first and who is responsible for restoring them.
For a small business, the useful comparison is not a vendor ranking but whether its current arrangements provide recovery confidence, isolation from compromised systems, appropriate authentication, manageable operations, and limited access for employees and third parties. If the business cannot maintain these controls internally, it may need help from a managed service provider (MSP) or incident-response specialist. CISA advises organizations to assess MSP security practices and limit third-party access.
Rank #2
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
What other safeguards reduce ransomware risk?
Backups address recovery; they do not stop every intrusion or prevent data theft. CISA’s guidance treats preparedness as layered. Alongside a tested recovery plan, organizations should:
- Use strong authentication: CISA recommends phishing-resistant multifactor authentication (MFA), especially for email, VPNs, and accounts with access to critical systems. A FIDO2 hardware security key is one possible route, but confirm that both the identity provider and the services in use support it before buying one.
- Update software and manage vulnerabilities: Apply security updates and address known weaknesses rather than leaving exposed systems unmaintained.
- Apply least privilege: Give employees, service providers, and systems only the access needed for their roles.
- Segment networks: Separate systems and limit pathways so that a compromise in one area does not automatically expose everything else.
- Maintain an incident response process: Assign responsibilities and plan how to contain an incident, communicate, and restore critical services.
These measures reduce exposure and improve resilience; they cannot guarantee that an organization will avoid ransomware. The CISA guide’s resource page lists a revision date of October 19, 2023, so organizations should also consult current official guidance and keep their plans aligned with their systems and threats.
Rank #3
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
What should a business do during a ransomware incident?
Recovery needs to be deliberate. Restoring too quickly from a backup while compromised systems or accounts remain active can reintroduce the problem. CISA’s guidance supports a response that contains the incident first, then restores services in priority order.
- Isolate affected systems. Limit the incident’s spread and prevent continued access to compromised devices or accounts. Follow the organization’s incident response process and seek qualified response support when needed.
- Assess impact and set priorities. Determine which systems and services are affected, then identify the critical operations that need to return first.
- Protect the recovery environment. Avoid reconnecting compromised systems or accounts in a way that could expose clean backup copies or restored systems.
- Restore from clean, offline backups. Use copies whose integrity and availability have been checked, and bring systems back in a controlled order.
- Verify operations. Confirm that restored services work and that the environment is not simply reproducing the original compromise.
What does the recent Play ransomware figure mean?
A June 4, 2025 joint CISA, FBI, and Australian Signals Directorate advisory said the FBI was aware of approximately 900 entities allegedly exploited by Play ransomware actors as of May 2025. That figure is specific to the Play group and the stated period; it is not a count of all ransomware victims. The advisory recommends measures including MFA, offline backups, recovery planning, and software updates. See the joint advisory on Play ransomware.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
