Ransomware attacks often deliberately target backups. Attackers first obtain extensive privileges, delete or encrypt the backups, and only then encrypt the production systems. Without an intact backup, there is hardly any way back. Immutable backups address exactly this.
How does an immutable backup work?
When a backup is written, a retention period is set, for example a few weeks. Until it expires, the storage system refuses changes and deletions, in the strictest form regardless of who issues the command. There are several technical ways to achieve this:
- Object storage with object lock: Many S3-compatible storage systems, on premises or in the cloud, support a lock based on the WORM principle (write once, read many).
- Hardened backup repositories: Systems with minimal access on which backup files are marked as immutable using an operating system feature.
- Specialized backup appliances with their own management, separated from the rest of the network.
The difference between a strict mode, in which no one can shorten the period, and a governance mode, in which specially privileged accounts may lift the lock, is important. Only the strict mode also protects when administrator accounts are compromised. A related approach is physical separation through offline media such as tapes stored off-site, often referred to as an air gap.
Typical examples
- Servers are backed up daily to independently managed object storage with a lock period of several weeks. Even an attacker with domain administrator rights cannot delete these backups.
- An accidentally deleted backup job does not take the already locked backup versions with it.
- The 3-2-1 backup rule is supplemented by an immutable or separated copy. The 3-2-1-1-0 variant additionally requires error-free verified recoverability.
What companies should keep in mind
- Separate the management of the backup system from the rest of the network and from the regular directory service, and secure it with multi-factor authentication.
- Choose the lock period so that even an attack discovered late is still covered.
- For on-premises systems, secure the time source, because lock periods are calculated based on the system time.
- Plan for additional storage requirements, since locked data is only released after the period expires.
- Also include backups of cloud services such as mailboxes and file storage, not just on-premises servers.
- Test restores regularly: immutability does not guarantee that the backed-up data itself is free of malware.