Why attackers hunt for backups first
Modern ransomware is rarely a single virus that runs the moment someone clicks a link. More often, an attacker gets in through a stolen password or an unpatched remote access tool, then spends days or weeks quietly exploring. One of the first things they look for is the backup system, because a business that can restore has no reason to pay. If the backup console uses the same domain admin account as everything else, they log in and delete the restore points before encrypting a single file.
That is why plenty of businesses that believed they had good backups still ended up negotiating with criminals. The backups existed, ran every night and reported success, but they were reachable with credentials the attacker already held. The fix is not more copies of the same kind; it is at least one copy that sits outside the attacker's reach no matter what access they gain.
What immutable actually means
Immutable storage uses a time-based lock. When a backup is written, the storage records that it cannot be modified or removed for, say, thirty days. During that window, a delete request is refused regardless of who sends it, even a full administrator of the backup account. Cloud object storage from the major providers supports this, often described as object lock or retention lock, and many backup products can switch it on for their cloud copies.
There are two common modes. A governance mode allows a specially privileged account to lift the lock, which is flexible but means that account becomes a target. A compliance mode allows nobody to lift it until the date passes, not even the provider's support team. For ransomware protection, the stricter mode is usually the right choice, with a lock period long enough to cover how long an attacker might lurk before acting.
Offline and air-gapped copies
An offline copy is the older approach and still works well for small offices. A backup is written to an external drive or tape, which is then unplugged and stored elsewhere. While it is disconnected, nothing on the network can reach it. Some businesses rotate two or three drives weekly, taking one home or to a second site each Friday.
The weakness is people. Drives get left plugged in because swapping them is a chore, or the person who rotates them goes on leave and nobody steps in. If you rely on rotation, put it on a calendar, name a backup person, and check the dates on the drives each month. A cloud copy with immutability enabled avoids the human step, which is why many offices now prefer it.
Separating the keys
Immutability protects the data; separate credentials protect the controls. The backup console should use its own accounts, not the same logins people use for Windows or Microsoft 365, and those accounts should have multi-factor authentication. Ideally the backup server is not joined to your main domain at all, so compromising the domain does not hand over the backup.
Keep the recovery details, including the backup provider's contact process and the account names needed to start a restore, written down outside your normal systems. During a ransomware incident, email, password managers and file shares may all be unavailable, and you will need to reach those details from a phone or a sheet of paper.
How long the lock should last
Pick a lock period based on how long an attack could go unnoticed. Many small businesses choose between fourteen and thirty days for daily backups, with longer locks on monthly copies. A lock that is too short can expire while the attacker is still inside, letting them wait it out and then delete. A lock that is too long can make it hard to remove data you genuinely no longer want, and immutable storage is billed for the whole lock period.
Talk through the trade-off with whoever manages your backups and write the decision down. Cyber insurance forms often ask whether backups are immutable or offline, how long they are kept and when a restore was last tested, and a clear answer helps both the application and any claim. Keep a screenshot of the lock setting with the date, so you can show it rather than describe it.
Checking what you have now
Ask three questions of your current setup. Can any account on our network delete every backup copy? If our main admin password was stolen tonight, which copy would survive? When did we last restore from that surviving copy? If the honest answers are yes, none, and never, the gap is significant but usually straightforward to close.
Most modern backup services can add an immutable cloud copy alongside what you already run, without replacing the existing system. It is one of the most effective changes a small business can make against ransomware, and it pairs naturally with multi-factor sign-in and good patching. Once it is running, restore something from the immutable copy specifically, so you know that path works and not just the everyday local one.
In short
- Attackers look for and delete reachable backups before encrypting.
- Immutable storage refuses deletion until the lock period ends.
- Offline drives work if rotation is scheduled and checked.
- Use separate, MFA-protected credentials for the backup system.