Building a Ransomware Clean Room in the Cloud: On-Demand Recovery with NC2 on AWS
When I hear the words clean room, my mind goes straight to Dexter — the TV show about a forensic blood spatter analyst who moonlights as a vigilante. His clean room is meticulous: sealed in plastic, no trace evidence, no contamination, nothing gets in or out. In some ways, it makes perfect sense as a metaphor. Dexter was in the business of containing and eliminating threats — and in the IT world, so are we. We are just going after ransomware actors instead of murderers. The plastic sheeting is a little different, but the principle is the same: isolate the threat completely before you do the work. Ransomware recovery used to mean one thing: restore from backup and hope for the best. That approach has a serious flaw — if your recovery environment connects to the same
