Attackers know that backups are the way out of a ransomware attack, so they hunt for them first. A backup system that shares credentials and a network with production is often encrypted or deleted before the ransom note appears.
The 3-2-1-1-0 rule
- 3 copies of your data.
- 2 different types of storage media.
- 1 copy offsite.
- 1 copy offline or immutable, which cannot be changed or deleted even by an administrator.
- 0 errors after automated verification and restore tests.
Design choices that make the difference
- Use immutable storage with a retention lock on at least one copy.
- Give the backup system separate credentials, ideally with multi-factor authentication, not joined to the production domain.
- Restrict network paths to the backup infrastructure and monitor them.
- Protect Microsoft 365 and other SaaS data, which is not automatically backed up for you.
- Keep recovery documentation and credentials somewhere that survives the loss of your main environment.
Test the restore, not the backup
Backups are only proven by restoring. Run scheduled restore tests for each tier of system, time them against your recovery objectives and keep the evidence. Once a year, rehearse the worst case: recovering the identity service and core applications from scratch.
Veeam and Commvault both support immutable and offline copy designs. The right choice depends on your environment, team skills and recovery targets.