Introduction

Ransomware operators often target backups because a single privileged credential can delete or encrypt recovery points. This post explores the architecture that separates attackers from your data, and where real defenses live.

What Happened

A breach frequently starts with a production identity that also reaches the backup console. From there, attackers can issue deletion or encryption commands. The article traces how a stolen credential moves through the stack, and why most environments fail when identity isn't properly segmented.

Why This Matters

Many teams assume immutability alone protects backups, but storage-level locks and network reachability are distinct. Immutability prevents alteration; air-gapping controls access. When identity chains span production and backup admins, a single compromise can undo both. Understanding the boundary between reachable and locked data determines whether recovery is possible or payment becomes the only option.

Key Takeaways

  • WORM enforcement happens at the storage layer, not the backup application, making it resilient even against privileged users.
  • S3 Object Lock's compliance mode blocks deletion even by the root user during the retention window, while governance mode allows bypasses.
  • Air-gapping only works if reconnection requires separate authority; otherwise, a privileged account can rewrite data before the next cycle.
  • Identity separation distinct admin accounts break-glass protocols and quorum-based deletion creates actual barriers a stolen credential can't cross alone.
  • Restore testing not just dashboard health checks confirms whether a backup can actually revive an application.

Conclusion

Every added boundary slows recovery and adds operational weight, but a backup that's immutable in theory yet reachable in practice solves only half the problem. The real test is whether a stolen credential runs out of authority before it runs out of targets. Harden the storage, harden who can touch it, and verify recovery because an untested architecture is no architecture at all.