Backups that survive ransomware
Ordinary backups protect you from a dead disk. They do not protect you from an attacker who has your credentials and deletes the backups first. Surviving ransomware means backups that even you cannot quietly erase.
Modern ransomware does not just encrypt your data — it hunts down and deletes your backups first, so you have no choice but to pay. A backup that your own compromised account can delete is not protection against this. The defence is backups that cannot be changed or erased, even with valid credentials.
Immutability is the key idea
An immutable backup, once written, cannot be modified or deleted until a set time passes — not by an attacker, not by you. Object storage with object-lock, or a backup target that enforces retention, gives you this. It is the single most important property a backup can have against ransomware. See object storage.
The 3-2-1 rule, still true
- 3 copies of the data
- 2 different media or systems
- 1 copy offsite — and, these days, one copy offline or immutable
Offline beats online
Anything reachable from the compromised machine can be attacked. A copy that is pulled to a separate system the production servers cannot reach — or written to media that is then disconnected — is out of the blast radius. Pull backups to the backup server, rather than letting each server push where it could also delete.
Separate the credentials
The account that runs backups should not be the account an attacker gets from your web server. Keep backup credentials out of the systems being backed up — see managing secrets. If one leaked password can both encrypt the server and empty the backups, you have one failure, not two.
Test the restore before you need it
Ransomware recovery is the worst time to discover your backups do not restore. Rehearse it: pull a backup to a clean machine and bring the service up from nothing — see testing a restore. The restore, not the backup, is the thing you are actually buying.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base