4

I'm seeing more and more cloud service providers advertising for what would be "Immutable backups" and calling alternatives "Legacy backups". (see Immutable backup on google)

This particular method would be immune to ransomware, as opposed to non-immutable backups.

The way it would work is to put a low level lock on the backed up data, making it impossible to modify.

I'm having IT providers advertise it and considering any alternative as unsafe, putting data and people at risk, etc.

Yet, I'm seeing none of that on stackexchange, which would be weird if this process was so important. I'm also having trouble with the term "immutable". Currently, backing up data on a remote server, encrypted, is the main method of off-site backup I know about.

Are Immutable backups now an important element in modern backup schemes to protect against ransomwares? Does it have to rely on third party providers to be called that way? Any alternatives?

Improve this question
3
  • It is a feature of some but not all backup solutions, which went to became a buzzword. And yes, it is important that ransomware cannot modify your backup because otherwise you cannot restore from it. And yes, ransomware specifically targets backups exactly because a working backup could prevent the victim to pay. And no, you don't necessarily need a third party for this, but you can implement it yourself with sufficient knowledge and time.
    – Steffen Ullrich
    Commented 11 hours ago
  • 2
    Be very careful. I've seen some providers call different implementations "immutable" when all they offer is a simple air gap. So, the use of the term can be marketing-speak. But the original concept is sound.
    – schroeder ♦
    Commented 10 hours ago
  • Related: security.stackexchange.com/questions/222082/…
    – mti2935
    Commented 6 hours ago

2 Answers 2

Reset to default
2

The key concept is that if an attacker with admin rights on your systems can destroy all your backups (which ransomware groups are known to do), then they don't really protect you against a ransomware attack. So you need a backup that cannot be destroyed even with full administrative rights.

If you go back a few years, people used to talk about the concept of offline backups, which were stored somewhere that was physically disconnected from your live systems (often on portable hard drives or tapes, and ideally also stored in a separate physical location). And those protect against the ransomware issue, because even if all my systems are compromised and an attacker can destroy everything online, they can't touch the tapes in a fireproof safe.

But with more and more stuff moving to the cloud, having offline backups is difficult (or expensive) for many people, so providers have implemented immutable backups to try and achieve the same thing - a backup that you can restore from, but that is impossible for an attacker who's compromised your account to destroy.

The main concern that a lot of people have around this approach is that you're really just having to try the third party when they say it's "immutable" and can't be deleted - so you don't have the same level of confidence that you would have in knowing that your backups are physically disconnected and stored in a locked box somewhere. And of course, they immutable backups don't necessarily protect against other things (like your backup provider going out of business, or suffering hardware failures/site outages/etc).

So the question you should really be asking is: if we get compromised, how can I stop the ransomware group destroying all my backups as well?

Immutable backups on a third party system are one possible answer to that, but they're not the only one.

Improve this answer
4
  • Another potential benefit of off-line backups is that someone who has physical control of backups of their work may resist outside demands for their destruction by a copyright troll or other such litigant than would someone who has no particular interest in the material in question.
    – supercat
    Commented 2 hours ago
  • @supercat: I'm sorry, I'm not sure I follow your comment. Are you saying "I prefer offline backups to cloud backups, because someone might try to get my cloud services provider to delete my cloud backups"?
    – ruakh
    Commented 2 hours ago
  • That's certainly how I interpret it. Someone who compromises a company badly enough may have gotten a copy of their password store (keylogger on the sysadmins' box?) to be able to log into the billing console and terminate the cloud account. No provider is going to keep hosting backups for someone who says they're not willing to pay for them -- and in many jurisdictions there are also laws obligating content to be deleted on-request. Physical media under one's direct control is less prone to such social engineering attacks.
    – Charles Duffy
    Commented 1 hour ago
  • @ruakh: If a music company convinces a judge to order the destruction of all copies of a video I created which criticizes them because it contains 5.1 seconds worth of their music. and that company goes to my backup provider with that order, the backup provider may not be have neither the motivation nor means to fight the order on the basis that any reproduced material was covered by fair use.
    – supercat
    Commented 1 hour ago
2

It's definitely important to protect your backups from malware or even just human error. Whether you call this “immutable backup” or something else doesn't matter. The concept is valid – and really nothing special.

There are many ways of implementing such backups. You can, in principle, use any storage that is write-once-read-many (WORM): newer generations of LTO tape, DVD-Rs and BD-Rs, USB sticks with a physical write-only switch etc.

It's also possible to emulate physical write protection with permissions. For example, I access my online backups through a read-only NFS share where the files are additionally protected through Unix permissions. This may not provide the same level of protection as low-level approaches, but it's obviously more convenient.

Third-party providers are another option, but, no, they aren't required.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .