What is an immutable backup, and how does it protect against ransomware?
Data availability and preservation are increasingly important for ensuring business continuity. Any enterprise, large or small, will usually undertake some backup procedures to protect themselves from data loss if disaster strikes the production. Earlier, we covered the types of backup in terms of frequency and partitions: incremental, differential, and full. There is also another vector to consider – immutability, which prevents the modification or deletion of data once it has been backed up.
What is an Immutable Backup?
You may have heard the term “immutable back-up repository” or simply “immutable back-ups” thrown around. What are they? Immutable backups are backups that cannot be tampered with. Unlike conventional (“mutable”) backups, when you assign immutability to a set of backup data, you are no longer able to edit or delete it for a specified time period, or even permanently. This prevents backups from being accidentally deleted, changed or meddled with by malicious third parties.
How do immutable backups work?
To create immutable backup files, you need to set something called an Object Lock that will lock the dataset for however long you wish. Whether you set immutability to physical devices or cloud storage, the same WORM protection mechanism is applied: write once, read many. Once the lock is set, it functions just like a timer, which, until it goes off, prevents any user or system administrator from changing the content of the backup in any way, but would allow them to view it multiple times.
Why Use Immutable Backups?
Immutability protects data backups not only from human error, but especially from ransomware attacks which can target an organization’s backups in order to corrupt or delete all secondary data copies and thus put the enterprise in a very vulnerable position. With a lockhold on all data copies, cyber attackers are at liberty to demand high ransoms. However, since immutable backups cannot be encrypted, they are very likely to fend off most ransomware attacks to the backups themselves or provide relief and recovery if other parts of the production environment succumbed to the attack.
Benefits of Immutable Backups
Immutable backups have enormous benefits to businesses and even individuals. Here are some of the advantages of immutable backups:
- One of the main benefits of immutable backups is that they allow for fast recovery and deployment to your production servers in the event of a breach or data loss.
- Once data has been written in an immutable backup, it cannot be altered or deleted for a set period. In the event of natural disasters, outages, and even ransomware attacks, immutable backups protect your data from corruption.
- Organizations in industries such as healthcare and finance need to adhere to rigorous data compliance rules in order to secure and protect sensitive information. Immutable backup capabilities is one of the tools that help them comply with these regulations.
How to implement immutable backups?
There was a time when doing backups involved simply having an extra copy of your primary data, but it was then quickly realized that the likelihood of losing both sets is higher than desirable. Backup demands have since expanded along with the availability of new backup software on the market.
3-2-1 and 3-2-1-1 backup rules
In the past, IT departments used the 3-2-1 backup rule, which emphasizes on keeping three total copies of your data, with two of them being on different media or platforms, and one stored offsite.
However, with time, this rule has been modified into the 3-2-1-1 which adds an additional layer of complexity and safety. It entails having one of the backups immutable or air-gapped.
Technologies and services to achieve immutability
Implementing immutable backup involves leveraging specific technologies and services like Write Once, Read Many (WORM) storage or media type, object lock features available in cloud storage services like Amazon S3 and Google Cloud Storage, and utilizing backup solutions that support immutability. It’s vital to integrate these technologies into a cohesive backup strategy, ensuring that at least one copy of the backup is stored in a manner that prevents alteration or deletion for a predetermined retention period, thus achieving immutability. Infrastructure planning should also consider secure network architectures, role-based access controls, and regular audits to ensure a secure and compliant backup environment.
Immutable Backup vs. Mutable Backup
Both of these types of backups offer approaches to data storage and protection. As the name suggests, immutable backup ensures that data that is stored cannot be altered or deleted for a specified retention period, providing a robust defense against ransomware and unauthorized data alterations, and ensuring data integrity and reliability during recovery operations.
Mutable backups, on the other hand, allow for changes and deletions, offering more flexibility and potentially reduced storage requirements, but at the potential risk of data tampering, accidental deletions, and being a more susceptible target during cyberattacks.
Air-gapped vs. Immutable Backup
Simply put, air-gapped backups are backups that reside on some sort of storage that is disconnected from the network. Air-gapping backups could be a decent way to prevent ill-intentioned users and third parties from accessing your environment remotely, however, these backups would not be immutable since they would still allow a user or anyone with access to the premises from meddling with the storage repository. Likewise, air-gapped backups can be edited and deleted at any time and therefore are not insured from human error.
StarWind and Immutable backup
StarWind Backup Appliance provides fast backup and restore speed, eliminating the backup window concept entirely. Its unique design also makes your entire backup infrastructure immutable and “air-gapped” (thanks to StarWind VTL) at the same time. Thus, extremely protected from ransomware on all levels, and exceptionally easy to manage.
FAQ
Are there any disadvantages to using immutable backups?
Unfortunately, no technology will ever be risk-free. Immutable backups are still prone to the kind of damage that any physical server could sustain, whether someone spills some coffee or the server building burns down. Even immutable backups, though they provide an additional thick layer of security, could still be susceptible to a successful ransomware attack. In addition to that, for those who have limited storage options, storing immutable backups that are locked for much longer than proves necessary could become a hassle and a waste of resources.
How often should immutable backups be updated?
This depends entirely on the needs and preferences of any given enterprise. Keep in mind that you may not want to be over-ambitious with immutability locks from the on-set for the aforementioned concerns regarding storage space. The frequency of your immutable backups would also be closely linked with the types of backups that you implement, as we’ve covered previously (link to Types of Backup). Continuously monitoring your backup environment may be costly and require continuous support, but at the end of the day, your peace of mind and your data’s safety are probably worth it.
This material has been prepared in collaboration with Asah Syxtus Mbuo, Technical Writer at StarWind.
