Comment Re:No. (Score 1) 125
Then, they pull the plug on the internet, scrub the computers, and restore from a recent backup. That is management.
This is stupidity.
Have any of the ransomware attacks taken the step of trashing/encrypting the backups and then waiting for some period to attack the live systems, so that restoring from a recent backup isn't an option? Most backup systems expire older backups on some schedule to avoid an unending increase in the size of their backup storage pool. So, an attacker could either destroy the backup system directly, or they could let the backup system destroy itself if they encrypted everything, but had the systems set-up to transparently decrypt everything with a key that "self-destructs" after several months.
A frighteningly high percentage of the places that I've worked had no real disaster recovery plan in place. Even the places that did have a good plan did their full recovery drills on a somewhat infrequent basis (annually was common), and having to revert everything to last year's fully tested complete backups with no further updates possible would be devastating to many organizations.