validating-backup-integrity-for-recovery

name	validating-backup-integrity-for-recovery
description	Use when validating backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.
domain	cybersecurity
tags	["incident-response","backup","integrity","hash-verification","restore-testing","disaster-recovery"]
subdomain	incident-response
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

Validating Backup Integrity For Recovery

Overview

Cybersecurity skill for validating backup integrity for recovery. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "validating backup integrity for recovery"
• "Validate backup integrity through cryptographic hash verification, automated res"

Use this skill when:

• Verifying backup integrity before relying on backups for ransomware recovery
• Building automated backup validation pipelines that run after each backup job
• Auditing backup infrastructure to confirm recoverability for compliance (SOC 2, ISO 27001, NIST CSF RC.RP-03)
• Detecting silent data corruption (bit rot) in backup storage before a disaster occurs
• Validating that immutable or air-gapped backups have not been tampered with

Do not use for initial backup configuration or scheduling. This skill focuses on post-backup validation.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Access to backup storage (local, NAS, S3, Azure Blob, GCS)
• Python 3.9+ with hashlib (standard library)
• Backup manifests or baseline hash files for comparison
• Isolated restore environment for restore testing
• Backup tool CLI access (restic, borgbackup, rclone, or vendor-specific)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v  IOC_PATTERNS.items()}