Immutable Backup: Ensure Data Security and Protection with BackupVault

“Immutable backup”: it may sound like something from The Matrix, but rest assured this is no theoretical fantasy. In fact, if you’re running a business and you’re using data backup that isn’t immutable, you’re facing some very real-world risks.

But what does “immutable” even mean? Essentially, it signifies “cannot be changed”, and in data backup terms it’s basically the difference between ensuring your backed-up data cannot be tampered with, and leaving it open to potential corruption, deletion, or lock-up by an unscrupulous third party or virus.

So, now we’ve got your attention, let’s take a look at how immutability works, how you can and can’t achieve it, and what the risks to your vital business data are if you make the wrong choices. 

Non-immutable: what’s the worst that can happen?

The whole point of data backup is that what is stored is an inviolable record of what went before. Anything that interferes with this makes a nonsense of the very notion of backup – and lack of immutability opens the door to exactly this kind of monkey-business.

Why? Because, as we briefly touched on in an earlier post, non-immutable backup solutions are one of the most common targets for ransomware, which not only locks up your data and holds it hostage, but can corrupt and obliterate it at will. In other words, pay the man, or lose your data.

This kind of attack is on the rise. Malicious emails of the kind that often trigger ransomware attacks have increased by 600% during the Covid pandemic, as reported in esecurityplanet.com.

And it’s often from these incursions that ransomware spreads, through the IT network, to the backup system. The backups themselves are not always attacked directly (although they certainly can be – hacker group DarkSide, for example, has reportedly made something of a specialism of this.)

Immutable backup: change is not an option

Immutable backup, on the other hand, makes the backed-up data read-only, so no changes at all can be made to it. It’s basically the digital equivalent of removing the -enabling ring on a traditional tape backup.

This is – clearly – absolutely critical to protecting what’s there, but it’s also kind of a no-brainer, because the very nature of backed-up data means that it should, under normal circumstances, never undergo any modification whatsoever – malicious or legitimate.

And when you consider that ransomware often infects backup systems by essentially tricking them into thinking the ransomware modifications are legitimate (a known weakness of what’s called the Changed Block Tracking method of network communication) it becomes clear that non-immutable backup solutions’ treatment of the data they hold fails on two counts!

So, how do you steer clear of backup like this? 

Backup: choose wisely…

First of all, there is often confusion between what is and isn’t backup. Microsoft 365 (previously Office 365) and Google Workspace (previously G Suite), for example, are not backup.

Yes, they store your data in the cloud, but they do not have any of the essential characteristics of true backup, as regards retention, granularity, readiness of access, and a whole host of other requirements. They simply store your data elsewhere. You still need to back it up. It might be helpful for you to quickly read our previous posts on this subject here (Microsoft 365) and here (Google Workspace).

And of course, if they’re not backup, they can’t be an immutable backup – so they’re off the menu.

Sticking with the cloud as the backup platform, though, is a good shout. No hardware to maintain, no software licences to purchase or update, no in-house security expertise needed, and it’s controllable and monitorable from a web-based console that you can access anywhere there’s an internet connection.

As for immutability, what you should specifically be looking for here is point-in-time recovery (PITR) that not only makes your backups impossible for ransomware to infect or delete whilst they are encrypted within the backup service, but enables entire servers – not just files and folders – to be rapidly recovered.

But it shouldn’t stop there. Whilst the right choice of immutable backup protects your valuable data and enables you to restore it should the worst happen, it is of course preferable that ransomware or other malware is detected and removed before it can attempt its dastardly deeds.

To this end, immutable cloud backup should also include inbuilt, active malware detection and removal, powered by intelligent machine learning.

The final cruel twist

So, immutable good, non-immutable bad – that much is hopefully now clear.

But should you find yourself struggling to justify the (very modest monthly) investment involved in moving to a cloud-based, immutable backup system, consider this.

Using non-immutable data backup that is compromised may not only rob you of the data your business depends on – it could even put you in breach of legal compliance that obliges you to ensure accurate copies of historical data are retained.

Hit by the hacker and then dragged through the courts. Talk about kicking you when you’re down…