Monday, 6:12 a.m.: The machines have come to a standstill, the MES is unresponsive, and a ransom demand appears on every screen. The backup system had been completely overhauled just the previous year. However, the attackers had been inside the network for weeks—and they had encrypted the backup catalog first. When a clean backup was finally located 32 hours later, no one knew which systems needed to be restored first. Production resumed after 30 days, but five orders were lost. In the meantime, the company’s most important customer opted for a second supplier.
While this scenario is fictional, we encounter such situations again and again in our projects. At the same time, regulations like NIS2 and DORA, along with increasingly stringent audit requirements, mandate that the ability to resume operations must not merely be claimed—it must be tested and proven.
Data backup alone isn't enough when a critical situation arises
Most organizations have processes in place for backing up and verifying data. However, they often lack the crucial steps required for recovery: prioritizing, planning, testing, and validation. Today, attackers deliberately target the recovery process—from initial access points and directory services to the backup repository itself. Furthermore, when the task of conducting a business impact analysis is delegated to the IT department, the result is merely a list of servers rather than a true set of priorities. In such a scenario, even the fastest hardware will attempt to restore everything at once—meaning nothing is recovered in time.
One attack, but different outcomes: with and without BCM
Based on the example of a fictional company, Muster GmbH, this webinar demonstrates how the company is confronted with an attack twice in a short period of time. By the second time—one year later—the company has taken proactive measures:
- A Business Impact Analysis (BIA) has been conducted in collaboration with the various departments.
- The backup system has been hardened, featuring immutable backups and a separate, third copy.
- The crisis management team is empowered to make decisions with clear authority.
- The response plan has been exercised twice a year.
- The result: Production is back up and running within 26 hours, and by 8:00 a.m., management is able to provide the customer with a reliable timeline.
Organization and Technology: The one-stop solution
The Empalis approach integrates two streams to facilitate a unified recovery process:
- Empalis BCM, based on ISO 22301 and BSI Standard 200-4: Quick Check, Enable, Operate, and Assure.
- Empalis Cyber Resilience: Assessment, VIKING, an isolated copy within the Empalis Sovereign Vault, and a cleanroom environment.
The Business Impact Analysis (BIA) determines which systems are to be prioritized for protection and testing. Hardened backups ensure that a clean, reliable copy is available in the event of an emergency. This ensures that none of the three pillars essential for a viable recovery—process, technology, and accountability—are missing.
Agenda
- Chronicle of a ransomware incident: the risks of relying solely on backups
- Why data backup alone does not guarantee a successful restart
- Prioritization via BIA (Business Impact Analysis): why only the business can decide what to restore first
- Ransomware-resilient architecture: immutable backups, air gaps, access control, and recovery zones
- Crisis management and drills: defining decision-making authority—and why untested recovery remains merely an assumption
- The roadmap: from initial assessment through "Enable," "Operate," and "Assure" to a proven, practiced capability
- Empalis BCM Quick Check: an independent two-day assessment, featuring a maturity "traffic light" system and prioritized recommendations
- Q&A
Speaker
Michael Melcher is a Senior Consultant and BCM Practice Lead at Empalis, where he is responsible for the development and implementation of holistic BCM (Business Continuity Management) strategies. With over 20 years of experience in IT resilience, architectural design, implementation, and project management, he integrates business continuity with data backup and recovery in his projects.
You will receive your access link along with your registration confirmation, as well as in two reminder emails sent shortly before the event. Simply use the link to join the event when it begins.
Please note that, depending on your web browser settings, you may be consenting to the use of your data within the WebinarGeek application. The use of your camera is entirely optional. When using the chat, only your first name will be displayed.
For full details regarding data protection when using WebinarGeek, please refer to our privacy policy.
Registration
Once you register here, you will receive your personal access link. Participation in the event is free of charge for you. Please note: The event will be held in German.
Register now
Download calendar entry
Get a reminder via a calendar entry before the event begins, and head into the session feeling relaxed.
Get in touch with us
Should you have any questions regarding the webinar—either beforehand or afterwards—please feel free to contact us directly.
Do you have any questions about BCM assurance or the webinar? Please feel free to send me an email.
Philip Röder, Head of Business Development & Consulting
Phone +49 162 4196789