Exercise 2: Why Ransomware Targets Backups First — Possible Solution
====================================================================

WHY BACKUPS ARE TARGETED FIRST: the entire leverage a ransomware
attacker has comes from denying the victim access to their own data
unless they pay. If the victim can simply restore from an unaffected
backup, that leverage disappears completely — the attacker has no
real bargaining position, since the "damage" is trivially undone.
By locating and destroying or encrypting the backups BEFORE (or at
the same time as) the live data, the attacker removes the victim's
escape route first, ensuring the ransom demand actually has teeth.

WHAT THIS IMPLIES ABOUT BACKUP STORAGE LOCATION: if backups are
reachable through the same network path, the same credentials, or the
same level of access as the live database, then compromising the live
system very often means the attacker ALSO has (or can easily get)
access to the backups in the same incident — turning one compromise
into a total loss of both the data and the ability to recover it.

This implies backups should be stored with genuine ISOLATION from the
live system — separate credentials, ideally a separate network path,
and access controls that don't automatically follow from whoever has
access to the live database. A backup an attacker can reach using the
exact same access that got them into the live database provides
essentially no real protection against this specific, well-documented
attack pattern.