Immutable backups and why ransomware targets backups first

Ten years ago, a ransomware infection usually meant restoring from last night's backup and moving on. Attackers noticed. Today, many ransomware groups spend days inside a network before they strike, and one of the first things they look for is the backup system.

If they can delete or encrypt your backups, you have no easy way back, and paying starts to look like the only option. Immutable backups are designed to take that option away from them.

How attackers go after backups

Ransomware attacks on businesses are rarely a single click followed by instant encryption. A typical pattern looks like this:

1. The attacker gets in, often through a stolen password, a phishing email or an unpatched remote access system.
2. They quietly look around and try to gain administrator rights.
3. They find the backup server, the NAS or the cloud backup console and use those admin rights to delete backup copies, change retention settings or encrypt the backup storage.
4. Only then do they encrypt the main systems and leave a ransom note.

Backups that sit on the same network, use the same admin accounts, or are always connected and writable are exactly what this approach is built to defeat.

What "immutable" actually means

An immutable backup is a copy that cannot be changed or deleted for a set period, even by someone with administrator access. Once it is written, it is locked until the retention period ends.

That lock has to be enforced by the storage itself, not just by a setting in the backup software that an admin could turn off. Common ways to achieve this include:

• Object lock in cloud storage. Many cloud storage services support an object lock or write once, read many mode. When it is set to a strict compliance style mode, no one can shorten the lock or delete the data early.
• Hardened backup appliances. Some backup systems use a locked down storage layer with its own credentials that ordinary admin accounts cannot reach.
• Offline or air gapped copies. A copy that is physically disconnected, such as rotated drives or tape, cannot be reached over the network at all.

Air gaps and the 3-2-1 rule

The classic 3-2-1 backup rule says to keep three copies of your data, on two different types of storage, with one copy offsite. Many IT teams now extend it to include at least one copy that is immutable or offline.

A true air gap is very strong but can be hard to manage for a small office, because someone has to swap drives and take them offsite every time. For most small businesses, a cloud backup with object lock gives a practical balance: it is offsite, it runs automatically, and it cannot be deleted during the lock period.

Other protections that matter just as much

Immutability protects the backup data. You also need to protect the doors around it.

• Separate credentials. The backup console should not use the same accounts as your Microsoft 365 or Windows domain.
• Multi-factor authentication on every backup and storage console.
• Limited access. Only a small number of named people should be able to change backup settings.
• Alerts for deleted jobs, shortened retention or unusual login activity.
• Long enough retention. Attackers may sit in a network for weeks. Keep restore points that go back further than that.

Questions to ask about your current backups

1. If someone stole our main admin password today, could they delete our backups?
2. Is at least one copy offsite and locked against deletion?
3. How far back can we restore, and is that long enough?
4. When did we last test a full restore, not just a single file?
5. Who gets alerted if a backup job fails or is changed?

If you cannot answer these quickly, that is worth fixing. Our guide to running a backup restore drill is a good place to start.

Immutability is not a full plan

An immutable backup gets your data back. It does not stop attackers from stealing data before they encrypt it, and it does not remove them from your network. Pair it with good security on accounts and devices, and with a written plan for how you would restore and in what order.

Getting help

Creative IT USA designs and monitors backup systems with immutable and offsite copies for businesses across Los Angeles County, the Inland Empire and Ventura County. Learn more about our backup and disaster recovery service, or ask us to review whether your current backups would survive an attack.