How to protect your backups from ransomware: 8 practical steps

Most backup systems are set up to survive accidents: a failed disk, a deleted folder, a broken update. Ransomware is different. A human attacker is inside your network, often with administrator rights, deliberately looking for the thing that would let you recover without paying.

The good news: you don't need an expensive new platform to defend against this. Most of the protection comes from how the backups are set up and run.

1. Keep at least one copy immutable or offline

   This is the foundation. An immutable copy can't be changed or deleted before a set date, even by an admin. An offline copy is disconnected entirely. Options include cloud object storage with object lock, a hardened Linux repository with immutability, or rotated drives or tape kept offline. If attackers get full control, this is the copy that saves you.

2. Separate backup administration from everything else

   In many attacks, the intruder simply logs in to the backup console. Use dedicated backup admin accounts that aren't your everyday or domain admin accounts. Where possible, keep the backup server out of your main Windows domain, so compromising the domain doesn't hand over your backups. Give each person only the rights they need, and remove old and shared accounts.

3. Turn on multi-factor authentication everywhere backups can be controlled

   That means the backup console, the cloud storage account holding your backups, and any cloud admin portals that could delete them. A stolen password alone should never be enough to delete a restore point.

4. Isolate the backup network

   Your backup server shouldn't be reachable from every laptop in the office. Put it on its own network segment and allow only the traffic it needs. Block remote desktop and file-sharing protocols to it from the general network. These are the routes attackers use to move around.

5. Keep retention longer than an attacker is likely to hide

   If attackers are inside for weeks before striking and you only keep two weeks of backups, every copy may already be compromised. Keep some older restore points, such as weekly and monthly copies, and make sure your immutable copy's lock period covers a realistic window. Then protect retention settings themselves, so nobody can quietly shorten them.

6. Encrypt backups, and keep the keys somewhere else

   Encrypt backups in transit and at rest so stolen backup data is useless to an attacker. Store the encryption keys or passwords separately, for example in a password manager with an offline copy, and check you can retrieve them during an outage. Encrypted backups with lost keys can't be restored.

7. Monitor for the warning signs

   Your backup system can be an early-warning system. Set alerts for several failed or missed jobs at once, changes to retention or schedules, mass deletion of restore points, and sudden jumps in how much data changed overnight, which can mean files are being encrypted. Send alerts somewhere a person will actually see them.

8. Test restores, including from the immutable copy

   Restore files every month and a full critical system every quarter, into an isolated network so nothing touches production. At least once a year, restore specifically from your immutable or offline copy, because that's the one you'll need in a real attack. Time every test and compare it with how long the business can afford to be down.

Where to start this week

If you can only do one thing, check whether you have a copy that an attacker with your admin password could not delete. If the answer is no, that's your first project. If it's yes, schedule a restore test from that copy.

For a broader checklist, the U.S. Cybersecurity and Infrastructure Security Agency publishes free guidance in its #StopRansomware Guide, including keeping offline, encrypted backups and testing them regularly.

Related: The 3-2-1-1-0 backup rule, explained for small businesses