Safeguards
Immutable backup
What is an immutable backup?
An immutable backup is a backup that can be neither changed nor deleted for a set period. Not by an administrator, and not by an attacker who has taken over that administrator's access.
Encryption attacks target the backups first. Whoever deletes the backups takes away the victim's only alternative to paying. To do so, attackers usually obtain administrator rights first and then work with the business's own regular tools.
This is exactly where immutability applies. The storage simply refuses the delete command for as long as the set period runs. The attacker's rights do not help, because the lock does not sit in the business's software, it sits in the storage itself.
Watch two points. The period has to be long enough, because attackers are often in the network for weeks before they strike. And the restore has to be tested, because an immutable backup is worth something only when the data can actually be brought back from it.
All terms in the knowledge base
Note: This entry reflects the state of knowledge to the best of our understanding and serves as general orientation. It is not legal advice. What counts is always the version currently in force at the responsible body, for example dsb.gv.at, nis.gv.at or enisa.europa.eu.
From the term to practice
Where does your business actually stand?
The IT Check reviews your IT across 8 audit areas with more than 100 individual checks and delivers documented findings with a prioritised action plan. From 1,299 € excl. VAT. The first call takes 20 minutes and carries no charge.