Ransomware is not limited to encrypting data on production servers. Attackers may also target the backup system by destroying recovery points, stopping backups from running, or gaining access to backup storage. Regular backups help, but they do not guarantee data will remain accessible when needed.
A ransomware-resilient backup strategy also requires ongoing monitoring and maintenance of the server and backup environment. Our Server Management services include backup monitoring and audits, security monitoring, and backup setup and restoration to help maintain the recovery environment.
A ransomware-resilient backup strategy must therefore protect backup copies from unauthorized changes or deletion while keeping recovery options available during an attack.
Immutable Backups and Air-Gapped Storage
Immutable storage is one way to protect backup copies from ransomware attacks. An immutable backup cannot be changed or deleted during a defined retention period. For example, a backup can remain protected for 30 days, providing a recovery point an attacker cannot simply remove.
WORM (Write Once, Read Many) storage and object-lock features commonly provide this type of protection. They help prevent backup data from being modified or deleted during the specified retention period.
Air-gapped backups provide another layer of protection. An attack on the production system does not automatically provide access to an isolated backup environment. This separation can help preserve a recovery copy even if the production environment and its online backups are affected.
You can implement air-gapped storage through offline storage or a dedicated backup environment. Isolating production systems from backup storage makes it harder for an attack on production to reach the backup copy.
Using immutable and air-gapped backups together provides an additional recovery option. If ransomware affects the production environment and its online backup, an air-gapped backup can remain available as another recovery point.
Regular monitoring and audits can also help identify backup-related issues before you need recovery. Our Server Management services include backup monitoring and audits, along with security audits and hardening.
Protecting the Backup Environment
Protecting backup storage is only one part of securing the backup environment. You also need to protect the accounts used to administer backups.
Use dedicated accounts for backup administration and follow the principle of least privilege. MFA adds another layer of protection, and management access should remain restricted. Separating backup administration from production administration can also help limit the impact of an attack.
Encrypt backup data both in transit and at rest. Also protect encryption keys so encrypted backups remain accessible when recovery is required.
Regular restore testing is equally important. A backup job may show as successful but still fail during recovery. Corruption, missing dependencies, permission issues, or configuration problems can prevent a backup from restoring when needed.
Regular restore testing helps verify that available recovery copies can be used during an emergency. This makes restore testing an important part of maintaining a reliable backup strategy.
Conclusion
A ransomware-resilient backup strategy involves more than taking daily backups. Recovery copies need protection from deletion, separation from production where possible, and regular testing before an emergency occurs.
Combining immutable backups, air-gapped storage, encryption, strong access controls, and regular restore testing can provide a stronger recovery setup. The goal is straightforward: when ransomware affects the production environment, a trusted recovery point should still be available.
