What ransomware does to a DMS
Ransomware encrypts the files it can access, then demands a ransom in exchange for the key. In a DMS, it acts with the permissions of the account or workstation it has infected. Three mechanisms make the damage worse:
- sync: the infected workstation encrypts its local copy, then the sync client sends the encrypted files to the server, like an ordinary change, and from there to the other devices;
- history: each encrypted file becomes a new version. The old version can save the day, unless the attacker has sufficient rights to purge the history and the trash;
- backup: ANSSI observes that an attacker often seeks to encrypt, erase or disable the backup infrastructure, to prevent rebuilding.
Some attacks also copy data before encrypting it. Restoring puts the files back in order. It does not deal with that part, which is a matter for crisis management and, where personal data is involved, the GDPR.
Reducing the blast radius
No one can promise that no workstation will be infected. You can limit what an infected workstation or account can reach.
Write permissions
An account that can only read a folder cannot encrypt it. Reference folders (templates, procedures, signed contracts) can be read-only for most people. Permissions are set by group and by folder, not “everyone edits everything.”
Administration accounts
ANSSI recommends keeping these accounts to the strict minimum. They must be named, protected by two-factor authentication, and not used for everyday work.
External links
A link that gives edit rights to a stranger is a door. Outgoing links have a password, an expiry date and, in general, read-only permission.
Synced workstations
Sync only the folders needed on each workstation. Leave sensitive folders in the browser. Install updates quickly: ANSSI stresses that it is crucial to do so within a short time frame and through a controlled process. The most common entry point remains email: see attachments, links and ransomware.
Why the backup must be out of reach
A backup accessible with the same account as production will be encrypted along with it. Three kinds of separation keep it safe:
- a different identity: ANSSI requires dedicated, named backup administration accounts, and an infrastructure independent of production directories;
- immutability: once written, a backup can no longer be modified or deleted during its retention period;
- another site, and if possible an offline copy: ANSSI considers it essential and more robust than an immutable backup that remains online.
Then there is depth. An intrusion can remain unnoticed for several weeks before the encryption. If retention is shorter than that delay, all available backups may contain the attacker or already corrupted files.
The recovery sequence
Restoring is not a button. It is a series of steps, and the order matters.
- Contain. Isolate infected workstations from the network, suspend compromised accounts, disable sync and external links for the affected scope. ANSSI also advises keeping a time-stamped incident log, disconnecting backup media after checking they are clean, and not powering off machines, which can erase useful traces.
- Date the start. Identify the first encrypted file, and the account and workstation involved. This is what sets the restore point.
- Choose the restore point before the encryption, with a margin if the date is uncertain.
- Restore onto a clean environment. ANSSI recommends reinstalling from known media, then restoring data from a backup taken before the compromise. Where the tool allows it, restoring only the affected scope avoids overwriting work done elsewhere since.
- Check. Open files at random, make sure no encrypted file remains, fix the entry point, change passwords.
- Reopen access gradually. Workstations resync from the restored server, never the other way around. A workstation that has not been cleaned and reconnects sends its encrypted files back.
In parallel, ANSSI recommends never paying the ransom, keeping the encrypted data (a key may be published later), filing a complaint, and having the crisis unit notify the CNIL in the event of a personal data breach.
What is lost: RPO in practice
Hypothetical case. A twenty-person firm backs up its documents every hour. On Monday, at 9:15 a.m., a synced workstation starts encrypting the “Clients” folder. The alert is raised at 10:05 a.m.
The last clean point is the 9:00 a.m. backup. The “Clients” folder returns to its 9:00 a.m. state. Changes made between 9:00 and 9:15 a.m. in that folder are lost. Those made in other folders are not, if the restore is limited to the affected folder. The assistant who saved three letters at 9:10 a.m. finds them in her mailbox and uploads them again.
This is what RPO, the maximum tolerable data loss, measures: the gap between the restore point and the incident. RTO, the maximum tolerable downtime, measures something else: the time before teams can work again. Both are decided before the incident, not during it.
Common mistakes
- Restoring before containing. The workstation still connected re-encrypts the restored files.
- Resyncing from the infected workstation. The local copy is the encrypted copy.
- Counting on the trash. It does not contain modified files, only deleted ones.
- Discovering the retention period on D-Day. If the intrusion dates back six weeks and retention is thirty days, choosing the restore point gets complicated.
Frequently asked questions
Is versioning enough against ransomware?
It helps if the history is intact. It is not enough if the attacker was able to purge it. The difference is explained in versioning, replication and backup.
Should you pay the ransom?
ANSSI recommends never paying it. Paying guarantees neither the key nor the absence of a new attack.
How do you limit who can modify a folder?
Through permissions by group and by folder. See setting who sees which documents.
How do you prevent a link from becoming an entry point?
With a password, an expiry date and read-only permission. See sharing links, partners and downloads.
Where Klytic fits
For Klytic Docs, backups run every hour. They are encrypted, immutable, replicated across several sites, monitored and kept for 30 days, and restores are tested every month. The targets are an RPO of under 2 hours for documents and an RTO of under 4 hours. A restore is requested from Klytic support, with the scope and the approximate date. It is included when the loss is caused by a malfunction of the Klytic service. After ransomware or a hacked account on your side, recovery is also included if your workstations were properly protected: updates applied, antivirus active. If they were insufficiently protected, it is subject to a paid support ticket, like a restore after a handling error. Details are on the security and backup page.
On the prevention side, Klytic Docs provides permissions per person, per group and per folder, two-factor authentication, an access log, and password-protected links with an expiry date. On Klytic’s side, technical access is limited to operations and support, named and logged.
The limits: thirty days of retention do not cover a compromise discovered later. Klytic restores its services; cleaning up your workstations, network and directory is the responsibility of your IT team or provider. Klytic is not a SecNumCloud-qualified offering.
This page describes a general framework. In the event of an incident, follow your recovery plan and the instructions of the competent authorities.
Sources
Consulted in October 2026.
- ANSSI and French Ministry of Justice (DACG), “Attaques par rançongiciels, tous concernés” (Ransomware attacks: everyone is concerned), 2020: disconnected backups, limiting administration accounts, rapid updates; in the event of an incident, incident log, isolation, no powering off, keeping encrypted data, not paying, filing a complaint, restoring from a backup taken before the compromise. messervices.cyber.gouv.fr
- ANSSI, “Sauvegarde des systèmes d’information” (Information system backup), guide ANSSI-BP-100, v1.1: attackers often target the backup infrastructure; dedicated accounts; offline more robust than online WORM; RPO and RTO (PDMA and DMIA). messervices.cyber.gouv.fr
- Klytic, Security and backup: immutable, encrypted, replicated backups, 30 days, restores tested every month, RTO under 4 h, RPO under 2 h. klytic.com
- Klytic, Hosting and sovereignty: technical access limited to operations and support, named and logged. klytic.com
