Key takeaways
- An immutable backup cannot be changed or deleted until its retention period ends, even by an administrator account.
- It protects against ransomware gangs that log in with stolen admin credentials and delete or encrypt backups before encrypting servers.
- Combine immutability with the 3-2-1-1-0 rule: three copies, two media, one offsite, one immutable or offline, and zero errors in restore tests.
Modern ransomware attacks rarely start with encryption. Attackers first gain administrator access, look for backups and delete or encrypt them, and only then encrypt servers. If your backups can be deleted by an administrator account, a single stolen password can remove your only way to recover.
What makes a backup immutable
Immutable storage uses write-once-read-many (WORM) behavior: once a backup is written, it cannot be changed or deleted until a set retention period ends. Common ways to achieve this:
- Object storage with object lock in compliance mode, on-premises or in the cloud.
- A hardened Linux backup repository with immutability, such as the one supported by Veeam.
- Backup appliances with built-in retention lock.
- Cloud backup services that offer immutable or locked copies.
Immutable, offline or offsite?
- Offsite protects against fire, flood or theft at your site.
- Offline or air-gapped protects because attackers cannot reach the copy at all.
- Immutable protects because even a reachable copy cannot be changed.
They are complementary. The 3-2-1-1-0 rule combines them: three copies of the data, on two different media, one offsite, one immutable or offline, and zero errors when you test restores.
Setting it up correctly
- Choose a retention period that covers how long an attacker might stay hidden, often 14 to 30 days or more for critical systems.
- Use separate credentials and MFA for the backup system and storage, not your domain admin account.
- Monitor backup jobs and alert on failures or unusual deletions.
- Test restores regularly, including a full server restore.
How Thoughts House can help
We design and run backup and recovery across Saudi Arabia with Veeam and other platforms, including immutable repositories, offsite and cloud copies, Microsoft 365 backup and regular restore testing.
Frequently asked questions
What is the difference between immutable and air-gapped backup?
An air-gapped backup is physically or logically disconnected from the network, such as tapes in a safe or a disconnected disk. An immutable backup stays online but cannot be modified or deleted until its lock expires. Both protect against ransomware; immutable storage is easier to automate.
Can immutable backups still be deleted?
Not through normal means before the retention period ends. That is why retention must be set carefully, and why access to the storage system itself and its management must be protected with separate credentials and MFA.
Does Microsoft 365 need its own backup?
Microsoft runs the service, but protecting your data against deletion, ransomware or account compromise is your responsibility under the shared responsibility model. A third-party backup with immutable copies is recommended.