easybackups - Best Practices for Secure and Efficient Data Protection

Ransomware changed what a backup has to be. For decades, the primary threats to data were accidents and hardware failure — problems that a simple second copy solved neatly. Today the most damaging threat is an adversary who deliberately hunts down and destroys your backups before encrypting your live data, then demands payment for the key. Protecting data against this kind of attack requires a different mindset, one where your backups themselves are treated as a target that must be defended. This article covers the best practices that make backups ransomware-resistant.

Want expert help putting this into practice? EasyBackups can guide you through it.

Understand how ransomware defeats ordinary backups

To defend backups, you have to know how attackers neutralize them, because modern ransomware crews plan for the fact that you have backups. After gaining access, they frequently spend days or weeks moving through a network quietly. During that time they look specifically for backup software, backup repositories, and cloud storage credentials. They delete or encrypt those backups first, and only then trigger the encryption of your production data — so that when you reach for your safety net, it is already gone.

This is why a backup that is simply "another copy on the network" offers little protection against a determined attack. If the malware or the attacker's stolen admin credentials can reach the backup, the backup can be destroyed. Synced cloud folders are especially vulnerable: they dutifully upload the encrypted versions of your files, overwriting the good copies. Recognizing this reconnaissance-and-destroy pattern is the foundation for every countermeasure that follows.

Make at least one copy immutable

Related: easybackups - essential steps for reliable data protection.

The single most effective defense is immutability: a backup copy that cannot be modified or deleted for a defined retention period, no matter who asks — not an administrator, not a compromised account, not the malware. Immutable storage enforces write-once-read-many behavior, so even an attacker with full credentials cannot alter or erase the protected versions until the retention window expires.

Object storage with an object-lock or retention-lock policy is the common modern implementation, and it is what turns "we have backups" into "we have backups the attacker could not touch." Set the immutability window longer than the time an intruder might realistically dwell undetected in your environment — often weeks — so that even a slow, patient attack cannot outlast the lock. When you build your backup architecture, treat at least one tier as immutable and non-negotiable; it is the copy that will still be there after everything reachable has been compromised.

Keep an air gap between backups and the network

Immutability's older cousin is the air gap: a copy that is physically or logically disconnected from the network most of the time, so that it simply cannot be reached by malware spreading through connected systems. Traditional air gaps were offline tapes or external drives rotated out and stored disconnected. Modern equivalents include copies in accounts with separate credentials that are only connected during the backup window, or storage that is otherwise isolated from your production identity system.

The principle is the same across implementations: a backup an attacker cannot reach is a backup an attacker cannot destroy. Combine air-gapping with immutability for defense in depth — one relies on unreachability, the other on unchangeability, and together they cover each other's edge cases. The practical goal is that after an attack, you always have at least one recovery point that was never exposed to the compromised environment, no matter how thoroughly the attacker owned the rest of it.

Isolate backup credentials and enforce MFA

See also: easybackups - Best Practices for Reliable Data Protection.

Because attackers weaponize stolen credentials against backups, your backup system's access must be walled off from everything else. Do not use the same administrator accounts for daily operations and for backup management. Give the backup system its own identities, protected by multi-factor authentication, and grant the minimum privileges necessary. The account that can delete backups should be rare, closely guarded, and monitored.

Separation matters because it breaks the attacker's usual path. When domain administrator credentials are compromised — a common scenario — you do not want those same credentials to also unlock the destruction of your recovery copies. Log every access to the backup repository and alert on high-risk actions such as bulk deletions, retention-policy changes, or attempts to disable immutability. Those alerts are often the earliest warning that an intrusion is underway, giving you a chance to respond before the ransomware payload fires.

Retain versions long enough to outlast the dwell time

Ransomware recovery depends on being able to restore a clean point from before the infection took hold, and infections are frequently discovered only after the attacker has been present for a while. If your retention only reaches back a few days, and the compromise began three weeks ago, your recoverable versions may all be tainted. Retention depth is therefore a direct ransomware defense, not just a convenience.

Keep a versioned history that comfortably exceeds typical attacker dwell time — many organizations retain daily or weekly recovery points for several months. This ensures that when you finally detect the attack, you can reach back past the initial breach to a genuinely clean state. Pair deep retention with the ability to identify when the compromise began, so you restore from the right point rather than reinfecting yourself by recovering an already-poisoned backup.

Rehearse ransomware recovery specifically

General restore testing is good; rehearsing a ransomware scenario specifically is better, because this recovery has unique complications. You will be restoring a large volume of data, possibly rebuilding systems from scratch, identifying the clean recovery point, and doing it all under pressure while ensuring you do not reintroduce the malware. Practicing this in calm conditions reveals gaps that a routine file restore never would.

Run a drill that walks through the whole path: detect, isolate, identify the last clean version, restore to rebuilt systems, and verify integrity before reconnecting. Measure how long it takes and whether your immutable copy is genuinely usable end to end. Platforms such as EasyBackups can provide the immutable, versioned, access-controlled backup tiers this defense requires and automate the verification restores that prove they work. The through-line of ransomware-era data protection is simple to state and demanding to execute: assume the attacker will come for your backups, and build copies they cannot reach, cannot change, and cannot outlast.