Immutable Backups: Why Attackers Go After Your Backups First

Ransomware operators are rational adversaries. They understand that an organization with good backups can restore its data and refuse to pay. Their response has been to target backups directly, seeking to encrypt or delete them before launching the main attack on production systems. Many organizations discovered this tactic the hard way, finding their backup repositories destroyed alongside their primary data. Immutable backups are the most effective countermeasure.

How Attackers Reach Backups

Attackers typically gain access to a network and move laterally, often for days or weeks, gathering credentials and mapping systems. If backup servers are joined to the same domain as production, or managed with the same administrative accounts, attackers can log in and delete backup data or alter retention settings. Some attacks also target backup software directly, exploiting vulnerabilities or using its own functions to purge stored data.

What Immutability Means

An immutable backup cannot be changed or deleted for a defined retention period. Even an administrator with full privileges cannot remove it until the period expires. This protection is enforced by the storage system itself, not merely by backup software settings that an attacker could change.

Implementation Approaches

Several approaches provide immutability. Purpose-built backup appliances can lock data at the storage level. Object storage with retention locks prevents deletion until the lock expires. Hardened repositories with restricted access and write-once behavior offer another option. Tape stored offline provides physical immutability. The strongest implementations combine immutability with isolation, ensuring backup systems are not reachable with production credentials.

Protecting the Control Plane

Immutability must extend to configuration. If an attacker can shorten retention periods or reset the system clock, protections may be circumvented. Secure systems require multiple approvals for sensitive changes and protect time sources from tampering.

Operational Considerations

Immutable storage requires planning for capacity, since data cannot be deleted early to free space. Retention periods should balance protection with cost. Compliance requirements may also influence retention settings.

Detecting Attacks Early

Monitoring backup systems for unusual activity, such as mass deletion attempts or changes to retention settings, provides early warning of an attack in progress.

The Bottom Line

Attackers target backups because destroying them increases the pressure to pay. Immutable backups, enforced at the storage level and combined with isolation, ensure a clean recovery copy survives. Protecting configuration settings and monitoring for suspicious activity strengthen the defense further. Organizations should verify that their backups are truly immutable rather than merely protected by software settings. This single capability can determine whether a ransomware attack is a crisis or an inconvenience.