Modern ransomware operators treat backups as a primary target. They enumerate backup servers, harvest backup credentials, delete snapshots and restore points, then encrypt what's left. Resilient backup architecture assumes an attacker with domain administrator rights and still guarantees a clean recovery.
1. Follow 3-2-1-1-0
Keep three copies of data, on two types of media, with one copy offsite, one copy offline or immutable, and zero errors after verification. The immutable copy is the one that matters most during a ransomware event.
2. Make at least one copy immutable
- Use object storage with object lock in compliance mode, where retention can't be shortened even by the account owner.
- Or use hardened, immutable backup repositories that aren't reachable with domain credentials.
- Set retention long enough to cover attacker dwell time, so you can restore from before the intrusion began.
3. Isolate the backup environment
- Don't join backup servers to the production domain. Use separate credentials, enforced MFA and ideally a separate identity boundary.
- Restrict network paths to the backup infrastructure to the minimum required for backup traffic and management.
- Protect backup administrator accounts with privileged access management and alert on any use.
4. Monitor for attacks on backups
Alert on deletion of restore points, retention changes, disabled jobs and unusual console logins. Endpoint detections for shadow copy deletion and recovery-inhibiting commands give early warning that an attack is underway.
5. Include SaaS and cloud workloads
Under the shared-responsibility model, platforms such as Microsoft 365 protect their service, not necessarily your data against deletion or malicious changes. Back up mailboxes, SharePoint, OneDrive and critical SaaS data to a separate, immutable destination.
6. Test recovery like you mean it
- Run regular restore drills for critical systems, measuring actual recovery time and data loss against your targets.
- Rehearse recovery into an isolated “clean room” environment, since production may not be trustworthy after an attack.
- Scan restored systems and data for malware and persistence before reconnecting them.
- Document restore order and dependencies — identity services and networking usually come first.
A backup you haven't restored is an assumption. A tested, immutable, isolated backup is a recovery plan.