Category: blog
AI-powered cyberattacks are increasing the speed and scale of ransomware operations.
Automated tools can support:
- Credential discovery
- Network reconnaissance
- Data classification
- Phishing campaigns
- Privilege escalation
- Backup targeting
- File encryption
- Data exfiltration
Production systems are not the only targets.
Backup systems are targeted first when attackers attempt to block recovery.
Immutable backups provide a recovery layer that cannot be altered or deleted during a defined retention period.
They are not a complete cybersecurity program.
They are a core recovery control.
Immutable Backups
An immutable backup cannot be modified, overwritten, or deleted before its retention period ends.
Common implementations include:
- Write once read many storage
- Object lock
- Retention lock
- Time-locked storage
- Offline media
- Isolated backup vaults
The protection must apply to the backup data and the administrative controls around it.
If a compromised administrator can disable immutability or shorten retention, the design is incomplete.
The National Cyber Security Centre ransomware-resistant backup guidance recommends isolation, separate credentials, least privilege, MFA, protected retention, version history, and alerts for privileged changes.
Why Ransomware Targets Backups
Ransomware operators attempt to prevent restoration before production data is encrypted.
Common actions include:
- Deleting backup jobs
- Encrypting backup repositories
- Removing recovery points
- Reducing retention periods
- Disabling security controls
- Compromising backup administrator accounts
- Flooding storage with corrupted recovery points
- Targeting cloud control planes
- Disabling logs and alerts
An accessible backup can be treated as production data.
A backup connected to the same identity system and network can be compromised through the same intrusion.
Immutability limits destructive actions.
Isolation limits access.
Redundancy limits single points of failure.
Testing confirms that recovery is possible.
Backup Redundancy
A single backup copy is not a recovery strategy.
A ransomware-resistant design should use multiple copies across different storage locations and administrative boundaries.
The 3-2-1-1-0 model provides a common structure:
- 3 copies of data
- 2 different storage media types
- 1 offsite copy
- 1 immutable or offline copy
- 0 restore errors during testing
A business environment may use:
- Production storage
- Local backup storage for fast restores
- An immutable cloud repository
- An isolated offsite repository
- Offline media for long-term protection
The copies should not depend on one shared administrative identity.
Separate credentials should be used for backup management.
MFA should be required for destructive actions.
Backup administration should be restricted to approved systems and users.
Network segmentation should be applied between production workloads and backup management interfaces.
CISA recommends maintaining offline encrypted backups and testing their availability and integrity during disaster recovery exercises. The CISA #StopRansomware Guide also recommends golden images, recovery planning, isolated restoration, and predefined recovery priorities.
RPO and RTO
Immutable storage does not define how much data can be lost or how long recovery can take.
Those requirements are defined by RPO and RTO.
Recovery Point Objective
RPO measures the maximum acceptable amount of data loss.
Examples:
- A 15-minute RPO allows up to 15 minutes of lost transactions
- A 4-hour RPO allows up to 4 hours of lost data
- A 24-hour RPO may be acceptable for lower-priority systems
RPO determines backup frequency.
Critical systems generally require more frequent snapshots, transaction log backups, or replication.
Lower-priority systems may use longer intervals.
Recovery Time Objective
RTO measures the maximum acceptable time to restore service.
Examples:
- A 1-hour RTO requires prepared recovery capacity and documented procedures
- An 8-hour RTO may support scheduled restoration activity
- A multi-day RTO may support archive-based recovery
RTO affects infrastructure, storage tiers, staffing, network configuration, application dependencies, and recovery automation.
Archive storage may reduce cost.
It may also increase restoration time.
Fast local storage may support operational recovery.
It may not provide sufficient protection if the local environment is compromised.
RPO and RTO must be defined by workload.
They should not be assigned only by backup software defaults.
Immutable Storage and Isolation
Immutability and isolation address different risks.
Immutability prevents changes during the retention period.
Isolation reduces the likelihood that attackers can reach the backup environment.
Controls should include:
- Separate backup networks
- Separate cloud subscriptions or accounts
- Separate administrative credentials
- MFA for backup administration
- Least-privilege role assignments
- Approval for retention or deletion changes
- Out-of-band alert delivery
- Restricted management interfaces
- Protected encryption keys
- Offline recovery documentation
Cloud backups should not automatically be treated as isolated backups.
A cloud repository can still be exposed through compromised credentials, shared tenants, misconfigured permissions, or compromised management accounts.
Microsoft’s ransomware-resilient backup architecture uses independent immutable backup copies across separate administrative and regional boundaries.
The design also includes:
- Dedicated backup subscriptions
- Separate vaults
- Locked retention
- Multi-user authorization
- Clean-room restoration
- Regular recovery testing
The same principles can be applied across on-premise, cloud, and hybrid environments.
Recovery Testing
A completed backup job does not confirm that recovery will work.
Restore testing should verify:
- Recovery point availability
- Backup integrity
- Application consistency
- File permissions
- Database functionality
- Network dependencies
- Authentication dependencies
- Recovery sequence
- Restoration duration
- Data loss against the RPO
- Service availability against the RTO
Testing should include the immutable copy.
Testing should include the offsite copy.
Testing should include a recovery environment separate from production.
A clean-room recovery process can reduce reinfection risk.
The selected recovery point is restored to isolated infrastructure.
The environment is scanned and validated.
Applications are tested.
Connectivity is restored only after approval.
The restored workload is then promoted for production use.
Recovery runbooks should identify:
- Decision makers
- System priorities
- Approved recovery points
- Required credentials
- Network changes
- Application dependencies
- Validation steps
- Communication procedures
- Escalation contacts
Testing frequency should match business risk.
Quarterly testing is a common baseline for critical systems.
Results should be documented.
Failed tests should produce remediation tasks.
X-Tek Managed Recovery Solutions
X-Tek supports business environments through managed IT services, infrastructure maintenance, cloud services, security monitoring, and backup monitoring.
Managed recovery solutions can be structured around the organization’s systems and recovery requirements.
The process can include:
- Asset and workload inventory
- Critical system classification
- RPO and RTO definition
- Backup policy review
- Redundancy planning
- Immutable storage configuration
- Backup network segmentation
- Credential separation
- Retention policy management
- Backup job monitoring
- Anomaly and failure alerting
- Restore validation
- Recovery runbook development
- Scheduled recovery exercises
- Post-test remediation
Backup status can be monitored continuously.
Failures can be identified and remediated.
Retention and configuration changes can be reviewed.
Recovery procedures can be maintained as infrastructure changes.
X-Tek provides business IT support and managed support plans for organizations that require ongoing maintenance and infrastructure oversight.
The X-Tek uptime page provides additional company information.
Recovery planning should account for:
- Servers
- Workstations
- Microsoft cloud services
- Google cloud services
- Network equipment
- File shares
- Databases
- VOIP systems
- Hosted applications
- Domain services
- Critical documentation
Each system should have a recovery priority.
Each priority should have defined RPO and RTO targets.
Each target should be tested against actual restoration performance.
Immutable Backup Checklist
Use the following checklist when reviewing backup resilience:
- Three or more total data copies are maintained
- Two or more storage types are used
- One copy is stored offsite
- One copy is immutable or offline
- Backup credentials are separate from production credentials
- MFA is required for privileged actions
- Backup management interfaces are isolated
- Retention cannot be shortened by a single administrator
- Backup changes generate alerts
- Encryption keys are protected separately
- Recovery points are scanned and validated
- Primary and secondary copies are tested
- RPO targets are documented
- RTO targets are documented
- Recovery runbooks are current
- Clean-room restoration is supported
- Recovery results are documented
AI changes the attack process.
It does not remove the need for established recovery controls.
Immutable backups, redundant copies, isolated administration, measured RPO and RTO, and tested recovery procedures provide the foundation for ransomware resilience.
X-Tek can review current backup architecture and define a managed recovery plan for business systems.
Contact Information
Business Solutions Information Request:
https://xtekit.com/business-solutions-information-request/
815-516-8075