Immutable Backup Architecture Explained: How WORM and Air-Gapped Storage Actually Stop Ransomware
A ransomware operator doesn't need to break your encryption to win. They need one thing: a credential with enough privilege to reach the backup environment, then either delete the recovery points outright or encrypt them alongside production. At that point, the incident stops being about unlocking data and becomes a question of whether there's any way back into production at all.
That's why backups get hit first. If a working recovery copy exists, the org doesn't have to pay, and attackers know that better than most defenders do. So the copy itself becomes the more valuable target, sometimes more valuable than production data. Saying "we have backups" was never actually answering anything.
The question is whether a compromised production identity can reach far enough into that backup environment to control it. In most environments it can, because immutability ships as a checkbox, the backup console gets treated as a management...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
