Ransomware, Blast Radius, and the Backup That Got Encrypted Too

If you want to understand why cyber attacks on infrastructure exploded from rare curiosities into a persistent operational hazard, follow the money. Early attacks on physical systems tended to be the work of nation-states — expensive, targeted, and rare, aimed at strategic goals rather than profit. What changed the landscape was the arrival of a scalable business model: ransomware. Once criminals discovered they could encrypt an organization's data, demand payment for the key, and get paid reliably enough to make it a going concern, the economics tipped. Attacking operators stopped being a stunt and became an industry, complete with specialization, affiliates, and customer-service desks for victims negotiating their ransom. That commercial character is why the threat is durable. You can occasionally deter a spy. You cannot easily deter a market.

Ransomware's mechanics are worth understanding plainly because they explain why it hits infrastructure so hard. The attacker gains a foothold — commonly through a phished credential, an exposed remote-access service, or an unpatched internet-facing system — and then, crucially, does not detonate immediately. The competent ones spend time moving laterally, expanding access, mapping the environment, and, above all, locating and neutralizing the backups. Only then do they encrypt, because encrypting everything at once while leaving a clean backup intact would let the victim simply restore and walk away. The whole leverage of the attack depends on making recovery impossible or agonizing. This is why so many ransomware victims discover, at the worst moment, that their carefully maintained backups were reachable from the same network the attacker controlled — and were encrypted or deleted right alongside the production data.

That detail is the single most important thing a newcomer to this subject can internalize, because it connects directly to everything the earlier modules taught about redundancy and independence. A backup that an attacker can reach and destroy is not a backup against an attacker. It is the exact cyber analogue of two generators in the same flooded basement — redundancy with a shared point of failure. The physical world's lesson about common-mode failure reappears here in digital clothing. The defense is the same in spirit: genuine independence. Backups that are offline, or immutable, or held in an account with entirely separate credentials — copies the attacker cannot reach even with full control of the production environment — are what turn a catastrophic ransomware event into a merely expensive, recoverable one. The organizations that recover well are almost always the ones that kept at least one copy truly out of reach.

The concept of blast radius, borrowed from the earlier discussion of failures, becomes sharper under adversarial pressure. Blast radius is the extent of damage a single compromise can cause. In accidental failures, blast radius is a matter of design; in adversarial ones, it is a matter of design that an intelligent opponent is actively trying to enlarge. An attacker who gains one set of credentials wants those credentials to unlock as much as possible. This is why flat networks — where any compromised machine can reach any other — are so dangerous, and why segmentation, the practice of dividing systems so a breach in one area cannot spread freely to others, is a foundational defense. Segmentation does for cyber blast radius what physical separation does for flood risk: it ensures that one bad event does not become total. The principle of least privilege — giving each account and system only the access it genuinely needs — is the same idea applied to permissions rather than networks. Both are attempts to shrink what a single compromise can touch.

There is a human dimension that no amount of technology resolves, and honesty requires naming it. The overwhelming majority of infrastructure intrusions begin not with exotic technical wizardry but with a person — a clicked link, a reused password, a helpful employee talked into resetting an account for a stranger claiming to be a colleague. Attackers target people because people are reliably the softest surface. This means resilience against cyber threats is never purely a technical program; it is also a training, culture, and process problem. The best-segmented network in the world still falls if an administrator with broad access is successfully deceived.

Which returns us, one last time, to the organizing idea of the course. The cyber incidents that fill the public record are, at bottom, an unusually candid form of failure — expensive lessons already paid for by someone else, published in enough detail to be studied. The recurring root causes are not secret: reachable backups, flat networks, over-privileged accounts, unpatched edge systems, and deceived people. An operator who reads those postmortems carefully receives, at no cost, the exact map of where they are likely to be hit. Failure is the cheapest intelligence — and in the adversarial domain, the failures of others are a gift you would be foolish to ignore. The intelligent response to a thinking opponent is to think first, and to do your thinking on someone else's tuition.