implementing-ransomware-backup-strategy

Follow the 3-2-1-1-0 rule: keep 3 copies on 2 media types, 1 offsite, 1 immutable or air-gapped, with 0 restore verification errors. Combine immutable storage like S3 Object Lock or Veeam Hardened Repository with isolated backup credentials and automated restore testing.

Immutable backups cannot be modified or deleted for a set retention period, even by administrators, using mechanisms like S3 Object Lock Compliance mode or Linux chattr flags. Air-gapped backups are physically isolated from the network entirely, such as offline tape, providing the strongest ransomware protection.

Set immutable retention to at least 30 days, longer for Tier 1 systems. Attackers dwell in networks an average of 21 days, so shorter windows like 7 or 14 days let them wait out the lock before encrypting backups.

Domain-joined backup servers let attackers who compromise Active Directory steal backup admin credentials via DCSync or Kerberoasting and delete every backup. Use standalone local accounts with hardware MFA, disable RDP, and block SMB paths from production to the repository.

Yes, Veeam 12 supports immutability through the Hardened Linux Repository using XFS with immutable file flags and single-use credentials, plus S3 Object Lock integration via Scale-Out Backup Repository capacity tiers for cloud copies.

Backups are a last line of defense, not a primary prevention control. They do not replace endpoint protection, network segmentation, or incident response planning, and they cannot prevent data exfiltration used in double-extortion attacks.