Modern ransomware often specifically targets and deletes backups before encrypting production data, defeating the recovery safety net entirely. Immutable backups — ones that literally cannot be modified or deleted for a defined period — directly address this threat.
Why Standard Backups Aren't Enough Against Ransomware
If an attacker gains sufficient access to delete or encrypt your backups (not just your production data), your backup safety net is defeated entirely — sophisticated ransomware specifically seeks out and destroys accessible backups as part of the attack, precisely to prevent easy recovery.
What "Immutable" Actually Means
A backup that, once written, cannot be modified or deleted — not even by an administrator with full credentials — until a predetermined retention period expires; this is enforced at the storage layer, not merely through access permissions that a sufficiently privileged attacker could bypass.
Object Storage Object Lock (S3-Compatible)
Many S3-compatible object storage services support "Object Lock" or similar immutability features — once enabled with a retention period, objects genuinely cannot be deleted or overwritten until that period expires, even by an account with otherwise full administrative access.
Configuring Object Lock (Conceptual Example)
aws s3api put-object-lock-configuration \
--bucket your-backup-bucket \
--object-lock-configuration '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"COMPLIANCE","Days":30}}}'Exact syntax varies by specific S3-compatible provider; the core concept (compliance-mode retention preventing any deletion/modification) is broadly consistent across providers supporting this feature.
Why "Compliance Mode" Matters (vs "Governance Mode")
Some systems offer both a stricter "compliance" mode (truly immutable, no override possible even by administrators) and a "governance" mode (immutable to regular users but overridable by specially-privileged accounts) — for genuine ransomware protection, compliance mode's stricter guarantee is what actually matters.
Air-Gapped/Offline Backup Copies (An Alternative/Complementary Approach)
A backup copy genuinely disconnected from your network (not just access-restricted, but physically/logically unreachable from a compromised system) provides similar protection through isolation rather than storage-layer immutability — a valid complementary or alternative strategy.
Using a Separate Account/Credentials for Backup Storage
Even without formal object lock features, using entirely separate credentials for your backup destination (not accessible from your main production server's compromised credentials) provides meaningful protection — an attacker who compromises your production server shouldn't automatically also have deletion access to your backup storage account.
Testing That Immutability Actually Works
Verify your configured immutability genuinely prevents deletion, even when attempting with full administrative credentials, during a controlled test — don't assume configuration was correctly applied without confirming its actual enforcement.
Balancing Immutability with Legitimate Deletion Needs
Immutability necessarily means you also can't delete backups early if you genuinely need to (accidentally backed up something sensitive that needs prompt removal, for example) — understand this trade-off and set retention periods thoughtfully, not simply maximizing duration without consideration.
Combining with Standard 3-2-1 Backup Practices
See Backup Strategy 101: The 3-2-1 Rule Explained — immutability enhances but doesn't replace fundamental backup best practices; combine multiple copies, multiple locations, and immutability together for genuinely robust protection.
Common Errors
Assuming standard cloud storage backups are automatically ransomware-proof — without explicit immutability configuration, standard object storage is just as deletable as any other storage if the attacker obtains valid credentials; immutability must be deliberately configured, not assumed.
Continue Reading
- Backup Strategy 101: The 3-2-1 Rule Explained
- How to Recover from Ransomware or a Compromised VPS
- How to Back Up to Object Storage (S3-Compatible)
Browse more articles in Backup & Disaster Recovery.
