Vlad Drumea performs some tests:
After the ANCPI hack that took down Romania’s land registry, Andrei Avădănei, CEO of Bit Sentinel and founder of DefCamp, published on LinkedIn a detailed proposal for a national offensive security program.
It covered pentesting frameworks, vulnerability disclosure, continuous monitoring, and accountability measures. The proposal was thorough, logical, and exclusively focused on prevention and detection.
I left a comment suggesting one addition: mandatory disaster recovery simulations.
Can institution X recover after their entire production environment is encrypted? If so, how long does it take and what data is lost? Are there backups? And if yes, are they actually viable, or are they Schrödinger’s backups, where you only find out whether they work at the exact moment you need them?
This exchange made me realize that organizations, especially in the public sector, rarely consider doing disaster recovery tests.
I’ve been on the edges of DR scenarios at prior jobs, including one at a state agency. Most of the time, the tests have to be hypothetical or piecemeal because we rarely had the hardware to support a full switch-over, or the budget to spin up an equivalent set of hardware in a different region.