Immutable backup can't be modified or deleted for a set period—not by users, not by admins, not by ransomware. It's backup that attackers can't destroy.
Quick answer: Immutable backup can't be modified or deleted for a set period—not by users, not by admins, not by ransomware. It's backup that attackers can't destroy.
Why This Matters
Ransomware attackers know you have backups. Modern ransomware specifically targets backup systems:
- Gain access to your network
- Find and encrypt your backups
- Then encrypt your production systems
- Now you have no recovery option except paying
How Immutable Backup Works
Immutable backups use technology that prevents modification or deletion for a defined retention period.
Write Once, Read Many (WORM): Once data is written, it cannot be overwritten or deleted until the retention period expires.
Even administrators can't delete it. This is the key point. Ransomware operators who compromise admin accounts still can't touch immutable backups.
Air-Gap vs Immutable
These are different concepts:
Air-gapped: Physically disconnected from the network. Ransomware can't reach it because there's no connection.
Immutable: Connected but unchangeable. You can access it for restores, but nothing can modify or delete it.
Best practice: Both. Immutable backups for rapid recovery. Air-gapped (or offline) backups as ultimate fallback.
What to Look For
When evaluating backup solutions:
- True immutability: Can an administrator delete backups? If yes, it's not truly immutable.
- Retention lock: Is the retention period locked at creation?
- Independent authentication: Is the backup system's authentication separate from your main domain?
- Geographical separation: Are immutable copies stored in a different location?
The 3-2-1-1 Rule
The traditional 3-2-1 backup rule (3 copies, 2 media types, 1 offsite) needs updating:
3-2-1-1: Add one immutable or air-gapped copy.
This ensures at least one copy survives even a sophisticated ransomware attack that compromises your backup infrastructure.
Real World
We've seen organisations hit by ransomware who:
Had backups, recovered quickly: Their backup system was immutable and separate. Ransomware couldn't reach it. They were back online in hours.
Had backups, still paid ransom: Backups were on the same network, same credentials. Ransomware encrypted everything including backups. Recovery impossible.
The difference was architecture, not luck.
What We Provide
Our backup solutions include:
- Immutable storage - Backups can't be modified or deleted during retention
- Separate authentication - Backup systems don't use your domain credentials
- UK data centres - For organisations with data residency requirements
- Regular testing - We verify backups actually work
---
about a backup assessment.
---