Immutable Backupsīefore we go into detail, we need to clarify what immutable backups mean. There’s light at the end of the tunnel (and I promise it’s not the oncoming train). Wouldn’t it be great to have immutable backups on your primary repositories on site? Good news. In case of a crypto attack time is crucial and the clock is ticking. Getting back offsite backups takes a considerable amount of time. There’s a similar option on AWS S3 buckets, which are usually used as offsite backup copies. It would be a better approach to protect backups against deletion for a defined timespan. But still, you’ll never know if attackers have knowledge of a zeroday exploit to takeover your backup server. In case the domain administrator account gets compromised there’s still (a little) barrier between attackers and your backup systems.
One first step is to separate your backup systems from your domain. Once they get credentials to the server, they can do whatever the backup-admin can do. Now the question is how to protect backup data in case an attacker gets hold on your backup server. Even worse: If you’re responsible for data backup, you might be facing unpleasant questions by the management. If that happens and you do not have an offline backup like tape or any other air gapped solution you’re up a creek without a paddle. No matter if your online backups are stored on a local repository or a cloud share. Not only do they ecrypt live data and entire virtual machines, they also have learned to delete or encrypt entire backups too. Attackers on IT infrastructure have become more sophisticated in recent times.
0 kommentar(er)
