Module 6 · 6.2

English

Nederlands English Deutsch

Backups that survive ransomware

Module 6: Backups · Reading time: 10 minutes

Learning objective: After this lesson, you'll be able to set up a backup that an attacker cannot encrypt or delete, by choosing an offline copy, immutable storage, versions with a suitable retention period and a separate login for the backup.
Key concepts: offline backup, air gap, immutable, object lock, versioning, separate login for the backup, retention period

Why a normal backup is often not enough

In lesson 1.3 you saw how ransomware works: someone gets in, looks around, and then encrypts everything they can reach in one go. "Everything they can reach" is the core problem. If your backup is on a network drive that's always mapped as a drive letter on your PC, then that backup is just a folder of files to the ransomware. It gets encrypted just as hard as the original.

The US cybersecurity agency CISA writes in its ransomware guide that many types of ransomware actively search for reachable backups in order to delete or encrypt them. An attacker who has your administrator account can also log into your backup program or cloud service and delete the backups there. That's why a ransomware resistant backup needs more than "there's a copy". It must be out of reach of anyone who has taken over your computer or your account.

There are three ways to achieve this, and ideally you combine them:

the backup is not connected (offline);
the backup cannot be changed or deleted, not even by an administrator (immutable);
the backup sits behind a different login than your everyday work.

Offline: the drive in the drawer

An offline backup is a copy that gets disconnected after it's made. An external drive that you unplug from your laptop after the backup and put in a drawer or a safe is the simplest example. Ransomware can only encrypt what's reachable, and a drive in a drawer isn't reachable. The term for this is an air gap: there's literally air between the backup and your network.

The NCSC advises the same: don't keep the backup connected to your computer, because otherwise ransomware can encrypt it along with everything else.

Pitfalls with offline backups:

Forgetting. A backup you make by hand gets skipped after a few busy weeks. Put a fixed day in your calendar and alternate between two drives, so there's always one off site.
Leaving it connected all the time. A drive that stays plugged in "for convenience" is no longer an offline backup.
Not encrypted. A loose drive with your entire administration is a data breach if it gets stolen. Turn on encryption (see lesson 5.2) and store the key somewhere other than the drive.

Immutable: immutability and object lock

An immutable backup cannot be changed or deleted by anyone for a set period. Not even by someone who has your password. Not even by the administrator.

With cloud storage, this technique is often called object lock. The documentation of one major provider describes it as write once, read many: you write a file once, and after that you can only read it until the retention period is over. There are usually two modes:

Mode	What it means	When to choose it
Strict mode (called compliance mode by that provider)	No one can delete the copy before the end of the period or shorten the period, not even the main account	You want certainty that even a hijacked administrator account can't delete anything
Flexible mode (governance mode)	Only accounts with a special permission can remove the protection	For testing, or if you want to keep the option of cleaning something up

Many backup programs and backup services offer immutable storage, under names like "immutable backup", "locked backup" or "WORM". When choosing, pay attention to three things:

How long is the lock? A lock of 7 days won't protect you if you only discover the attack after three weeks.
Who can remove the lock? If you can do that with the same account you log in with every day, an attacker can too.
What does it cost? Immutable also means you can't clean it up. CISA warns that a misconfiguration can lead to high costs. Start small and test.

Versions and retention period: how far back can you go?

A backup from yesterday only helps if everything was still fine yesterday. Ransomware sometimes waits a while before striking, and a mistake (a deleted folder, an overwritten price list) is sometimes only noticed weeks later. That's why you need versions: multiple backup points side by side. The retention period determines how far back you can go. The NCSC puts it this way: the retention period indicates how far back you can go in a backup's history.

A commonly used pattern is thinning out: a daily backup kept for a few weeks, a weekly one kept for a few months, and a monthly one kept for longer. This way you can go far back without keeping hundreds of full copies.

Questions to help you choose your retention period:

How quickly do you usually notice something is wrong? Look at past mistakes.
Are there legal retention requirements, for example for your business records? A backup is different from an archive: an archive is kept for years in a fixed place, a backup rotates.
How much storage does it cost? Keeping things longer costs more.

A separate login for the backup

The third measure is the cheapest and the most often forgotten. If your backup service, your cloud storage and your email all use the same account, and that account gets taken over (lesson 1.4), the attacker has everything in one go.

Use a dedicated account for the backup service or backup program, with its own unique password from your password manager, and turn on two-factor authentication.
Don't use that account for everyday work, and don't log in with it on the computer where you email and browse.
Where possible, let the backup program only write to the backup location, not delete.
Decide who has access, both physically (who has the key to the cabinet with the drive) and in the software. The NCSC explicitly mentions this too.

In practice: what it looks like

At the example provider WebOké, the nightly backups of a hosting package are stored on separate storage servers in a different data centre, apart from the server where the website runs. According to the knowledge base, you can't delete those nightly backups yourself: they remain in place so there's always a recovery point, and disappear automatically after 30 days. Only an extra backup you've made yourself can be deleted, and the panel asks for your password to do that.

What you add yourself to achieve the 3-2-1 rule and the offline copy: occasionally download a backup (it stays available for 48 hours) and store it on a drive that you then disconnect. A snapshot of a VPS is explicitly not a backup, according to the same knowledge base, because it's stored on the same storage as the VPS itself.

With other providers it may work similarly or quite differently. Ask your provider directly: are the backups separate from my account, can I or someone with my password delete them, and how far back do they go?

Summary

Ransomware encrypts everything it can reach, including connected backups, and attackers actively search for backups.
Offline: disconnect the backup drive and alternate drives, with encryption.
Immutable (immutable, object lock): no one can delete the copy until the period is over.
Versions and a suitable retention period determine how far back you can go; choose based on how quickly you usually discover problems.
Use a separate, well secured login for your backup, apart from your everyday account.

Quiz

Exercise

Exercise D6.2: Make one backup ransomware resistant. Choose your most important data (for example your business records or your website) and set up one copy that's out of reach: an external drive that you disconnect after the backup and store elsewhere, or a backup service with immutable storage. Give the backup its own login with two-factor authentication, check how far back you can go, and note who has access. Finally, answer the reflection questions.

Exercise D6.2: Make one backup ransomware-resistant

Here's how: (1) Choose the data you can least afford to lose (for example your accounts or your webshop). (2) Choose one of two routes: (3) Give the backup its own login: a separate account with a unique password from your password manager and two-factor authentication, which you don't use for mail or daily work. (4) Check how far back you can go (retention period) and write it down. (5) Note who has physical access (drive, safe) and who has access in the software to the backup. (6) Ask your hosting provider or IT partner: are the backups separate from my account, can someone with my password delete them, and how far back do they go? Write down the answer.

There's at least one copy that isn't connected or can't be deleted.
The backup has its own login with two-factor authentication.
The offline drive is encrypted and the key is kept somewhere else.
The retention period is known and written down.
There's a recurring appointment in the calendar (for the offline route).
The answer from the provider or IT partner is written down.

Suppose someone takes over your admin account tonight. Which of your backups could they delete, and which not?

How long did it take the last time you had a problem (a deleted file, a mistake) before you noticed? Does your retention period cover that?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing