Immutable backup

A backup copy that cannot be changed, encrypted or deleted for a set period, even by an administrator, protecting it from ransomware and malicious insiders.

Immutable backups use storage technology that locks data once it is written. Until the retention period ends, the backup cannot be altered or removed, regardless of who is logged in. Many cloud backup services and backup appliances now offer immutability as a feature, sometimes described as object lock or write once, read many (WORM) storage.

Ransomware groups know that good backups let victims recover without paying, so they often look for backup systems and try to delete or encrypt them before launching the main attack. If an attacker steals administrator credentials, a traditional backup may offer little protection. An immutable copy gives you a recovery point that the attacker cannot touch.

Practical tip: ask your IT provider whether at least one of your backup copies is immutable or offline, and for how many days it is protected. Choose a retention period long enough to cover the time an attacker might remain undetected, and test restoring from the immutable copy, not just from your primary backup.