From shared storage incidents to recovery exercises
Preparing for incidents affecting shared storage requires more than reading about backups. It also requires experience of restoring data and checking that it can be used for business. Using Saga University’s incident announcement as a starting point, this article considers a learning route combining cyber range activities and tabletop exercises.
What Saga University’s announcement confirmed
In its announcement on 28 September, Saga University explained that it had identified suspected ransomware damage to a NAS device used by its administrative department on 24 September, and that its CSIRT had led the response. It stated that administrative workstations returned to use on 27 September and normal administrative work resumed on 28 September. At the time of the announcement, no impact had been confirmed on systems supporting teaching, research or clinical services [1]. It would therefore be inaccurate to describe this as an incident that halted teaching or clinical services across the university.
Reconsider the role of shared storage
This case prompts organisations to check which activities and people their NAS devices and shared folders support. A common storage location can accumulate everyday documents, personal information and material needed for recovery. As more people gain access, managing permissions can become harder. This is not an assertion that the affected organisation had inadequate controls. It is a prompt to review whether the breadth of sharing introduced for convenience is still necessary for current work.
Keep copies that can support recovery
Backups that can be changed using the same credentials or administrator privileges as shared storage may be affected by the same incident. CISA recommends offline, encrypted backups of critical data and regular testing of their availability and integrity [2]. When reviewing your preparations, test whether required files can be restored in an isolated environment, rather than checking only whether backup jobs completed successfully. Business staff should also verify that the contents are correct and that the data represents the required point in time before judging whether a copy is suitable for restoring operations.
Combine SudoRange with supplementary exercises
When using SudoRange, consult the actual catalogue and select labs that match the learning objectives, such as networking, operating-system permissions or log analysis. This article does not establish that a specific lab is available which directly reproduces a NAS ransomware incident or its recovery. Restoration and business validation could be covered in another authorised test environment or a tabletop exercise. Keep the learning sequence in mind: study the knowledge, check it through practical work and explain the results.
Check four outcomes in an exercise
Use fictional files and an authorised environment for practice, without introducing production systems or actual leaked data. First, explain what should be isolated and why. Next, check the access permissions required. Then restore a backup, and finally have business staff check the contents and when the data was last updated. Assess not only whether restoration succeeded, but whether participants can explain which data was restored, what was lost and what they checked before operations resumed. Return to CyBOK’s Network Security or Security Operations & Incident Management to review points that caused uncertainty during the exercise.
Next to read
Turning Knowledge into Practice — What Can You Learn with a Cyber Range and SudoRange?
Discover how a safe exercise environment can connect knowledge with practical actions and decisions.
What Can You Learn from CTF? — Making Cyber Challenge More Than a Competition
Explore how reflecting on an exercise can help you identify what to learn next.