Why Every Backup Plan Now Needs a Copy That Cannot Be Changed
Ransomware groups learned some time ago that encrypting a company’s files is not enough. If the company can restore from backup, it has little reason to pay. So many attacks now go after the backups first, deleting or encrypting them before the main systems are touched. Data protection vendors such as Veeam have responded by building features around one idea, which is keeping at least one backup copy that nobody can alter or delete for a set period.
For many organisations, that single copy is the difference between a hard week and a business that cannot recover.
How Attackers Reach the Backups
Most backup systems are connected to the same network as the servers they protect. That makes daily backups easy to run, but it also means an attacker who gains administrator access can often see the backup storage too.
Once inside, attackers commonly delete backup files, change retention settings so older copies expire early, or encrypt the backup storage along with everything else. Some wait for weeks before acting, so that even older backups already contain their tools.
None of this requires advanced skills. Stolen passwords and weak administrator accounts are often enough.
What an Immutable Backup Is
An immutable backup is a copy that is locked for a fixed period after it is written. During that time it cannot be changed, encrypted or deleted, even by a user with full administrator rights. When the lock period ends, the copy can be removed in the normal way.
This lock can be applied in different places. Some cloud storage services offer object lock features. Certain backup appliances and hardened Linux repositories provide the same protection on local storage. Tape stored offline gives a similar result through physical separation, since a tape on a shelf cannot be reached over a network.
Finding Problems Before Restoring
A locked copy protects against deletion, but it does not tell anyone whether the data inside is clean. If malware was already present when the backup ran, restoring that copy can bring the infection straight back.
This is why scanning backup data has become common. Platforms like Veeam can watch backup data for unusual changes, such as a sudden jump in encrypted files, which may signal an attack in progress. Scanning a restore point before bringing it back into production helps teams pick a clean version.
Keeping several restore points over a longer period also helps. If the latest copies are affected, an older clean copy is still available.
