A dedicated backup server
Backups that live next to the thing they protect share its fate. A dedicated backup server — separate box, separate network — is the whole point.
Separation is the feature
If a backup target can be reached and deleted by the same credentials that run your production app, a single compromise takes both. A dedicated server, on a different network and ideally with a different provider, is what makes a backup a backup rather than a second copy waiting to be lost together.
Size it for retention, not just for one copy
Capacity is the full retention chain — dailies, weeklies, monthlies — plus room for growth and for the deduplication metadata. This is a classic storage-heavy build: lots of cheap terabytes, wide RAID, a hot spare.
Keep part of it out of reach
The copy that defeats ransomware is the one the attacker cannot delete: pull backups to the target rather than letting production push and overwrite, use append-only or immutable snapshots, and keep an offline rotation. See ransomware-resistant backups and prove the whole thing with a restore test.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base