Backup & Disaster Recovery deep dive
Backups exist for one reason: the day ransomware encrypts your network. The right ones survive. The wrong ones don't.
The reason every modern SMB needs serious backups is one word: ransomware. The attack pattern is now standard — attackers encrypt your production data and your accessible backups simultaneously, then demand payment for a decryption key. Without recoverable backups, the choice is paying the ransom (no guarantee), rebuilding from scratch (catastrophic data loss), or going out of business. With recoverable backups, the choice is restore-and-resume. The backup industry has spent two decades publishing the 3-2-1 rule (three copies, two media, one offsite) for exactly this reason — and most SMBs still do not actually have a 3-2-1 backup. AMTech designs backup architecture that meets ransomware-aware recovery objectives, then proves it with quarterly restore tests.
The three reasons clients still lose data
Every SMB ransomware-recovery post-mortem AMTech reviews lands on one of these three failure modes. The fix is the same every time: a tested, multi-tier backup architecture that includes immutable storage and explicit SaaS coverage.
Untested backups are not backups
Backup software reports "successful job completion" all the time. The first time anyone actually attempts a restore is during a real incident, when discovery of a corrupt backup or a missing dataset is catastrophic. AMTech runs restore tests quarterly on a sample of every protected workload. A backup that has not been restore-tested is not a backup; it is a hope.
SaaS data is not backed up by the SaaS provider
Microsoft 365 and Google Workspace are highly available, but neither is your backup. Microsoft’s own published guidance recommends a third-party backup for M365 data: accidental deletion, malicious deletion, retention-policy gaps, ransomware-encrypted SharePoint files, and account-takeover-driven data loss are all on you. Same story for Google Workspace.
Production-attached backups die with production
A backup repository sitting on the same network as production is reachable by ransomware as soon as the attacker compromises the domain. Air-gapped or immutable storage is the only architecture that survives a network-wide encryption event. Anything else is a "snapshot" you will lose alongside everything else.
Four-tier backup architecture
Each tier exists for a different failure mode. Together they satisfy the 3-2-1 rule and add the immutable layer that makes ransomware-recovery actually work.
Local snapshot
Fast-recovery snapshots on each protected workload. RPO measured in minutes, single-file restore in seconds.
Onsite repository
Image-level backups of every server and workstation, plus mailbox-level for Exchange and SaaS. Daily incrementals, weekly fulls.
Cloud-replicated
Every onsite backup replicated to OpenText / Carbonite cloud, encrypted in transit and at rest. Survives a site-level event.
Immutable / air-gapped
A subset held in write-once storage that ransomware cannot encrypt or delete, even with full domain admin credentials.
What AMTech protects
Backup coverage spans every workload your business depends on, including the SaaS data Microsoft and Google explicitly say is not their responsibility.
Servers
Image-level backup for fast bare-metal restore. Application-aware for SQL Server, Exchange, Active Directory, and SharePoint on-prem.
Workstations
Endpoint backup of user folders, bookmarked locations, and key configuration. Cloud-restore to a replacement device after theft, drive failure, or ransomware.
Microsoft 365
Mailboxes, OneDrive, SharePoint, Teams chat, Calendar — third-party backup independent of Microsoft’s own retention. Granular item-level restore.
Google Workspace
Gmail, Drive, shared Drives, Calendar, Contacts — third-party backup independent of Google’s own. Same granular restore model.
AWS workloads
EBS snapshots, RDS exports, S3 cross-region replication, EC2 image backup. AWS Backup orchestration centralized across workload accounts.
Specialized line-of-business apps
Medical practice management (Athena, eClinicalWorks, Epic ambulatory), legal practice management (Clio, MyCase, PracticePanther), financial portfolio management, manufacturing ERP. AMTech writes the backup-and-restore runbook per app.
RTO, RPO, and DR rehearsal
You should know exactly how long a real disaster will take — before it happens.
Every protected workload has a documented RPO (recovery point objective — how much data are you willing to lose, measured in time) and RTO (recovery time objective — how fast you must be back online). For most SMB workloads we target RPO of 4 hours and RTO of 8 hours. Mission-critical workloads — EHR for healthcare, trading systems for financial firms, financial-close infrastructure — target RPO 1 hour and RTO 2 hours. Total AMTech Shield clients get a quarterly DR rehearsal: we restore a sample workload to a fenced environment, time the operation, and report against your stated objectives. The first time you discover your real recovery time should not be the day of the incident.
3-2-1
Plus immutable layer
Quarterly
Restore tests (every workload)
4hr / 8hr
Default RPO / RTO
1hr / 2hr
Mission-critical RPO / RTO
- 3-2-1 architecture
- Quarterly restore testing
- Immutable cloud retention
- M365 + Workspace SaaS backup
- AWS workload backup
- RTO + RPO per workload
- Bare-metal recovery
- DR rehearsals (Total Shield)
- Ransomware-survivable