# Immutable backup

**What is an immutable backup?**

An immutable backup is a backup that can be neither changed nor deleted for a set period. Not by an administrator, and not by an attacker who has taken over that administrator's access.

Encryption attacks target the backups first. Whoever deletes the backups takes away the victim's only alternative to paying. To do so, attackers usually obtain administrator rights first and then work with the business's own regular tools.

This is exactly where immutability applies. The storage simply refuses the delete command for as long as the set period runs. The attacker's rights do not help, because the lock does not sit in the business's software, it sits in the storage itself.

Watch two points. The period has to be long enough, because attackers are often in the network for weeks before they strike. And the restore has to be tested, because an immutable backup is worth something only when the data can actually be brought back from it.

## Related terms
- [Backup and restore](https://vetosec.at/en/it-security/backup-wiederherstellung/)
- [The 3-2-1 backup rule](https://vetosec.at/en/it-security/drei-zwei-eins-regel/)
- [Ransomware](https://vetosec.at/en/it-security/ransomware/)
- [RTO and RPO](https://vetosec.at/en/it-security/disaster-recovery/)

## Source
https://vetosec.at/en/it-security/unveraenderliche-sicherung/ (vetosec, schutz)