Cloud · 5 min read
Ransomware-ready: immutable backups and the 3-2-1-1-0 rule
Modern ransomware goes after your backups first. How the 3-2-1-1-0 rule and immutable storage keep a clean copy out of the attacker's reach.
· Bhargava Group
Ransomware was present in 44% of the breaches analysed in Verizon’s 2025 Data Breach Investigations Report. Attackers learned long ago that encrypting production systems is only half the job. If the victim can restore from backup, there is no leverage. So the first thing many ransomware operators do after getting in is find the backups and delete or encrypt them.
A backup strategy that works against ransomware has to assume the attacker has administrator credentials.
The 3-2-1-1-0 rule
- 3 copies of your data: production plus two backups.
- 2 different types of storage or media.
- 1 copy off-site, in a separate location or cloud region.
- 1 copy immutable or offline, which cannot be changed or deleted before its retention expires, even by an administrator.
- 0 errors when you test a restore.
The last two numbers are the ones most often missing.
Immutability, explained
Immutable storage uses write-once retention locks: once a backup is written, no one can modify or delete it until the lock expires. Object storage with object lock in compliance mode, hardened backup repositories and immutable cloud vaults all provide this. The retention period should comfortably exceed how long an attacker might sit in your network before acting, which is often weeks.
Separate the keys
- Use a separate identity for the backup system, not your everyday domain admin accounts.
- Protect backup consoles with phishing-resistant MFA.
- Require multi-person approval for destructive actions such as shortening retention or deleting jobs, where your platform supports it.
- Alert on any attempt to change retention or delete restore points.
Back up your SaaS too
Microsoft 365, Google Workspace and line-of-business SaaS platforms keep your data available, but their native retention is not a substitute for an independent, immutable backup you control.
Test like it is real
At least quarterly, restore a full system, not just a file, into an isolated environment. Time it. Compare the result with your recovery time objective. Scan restored data for malware before bringing it back into production.
The payoff
With a clean, immutable copy and a practised restore, a ransomware incident becomes an outage you recover from, not a negotiation.
Our Cloud & Infrastructure practice designs and operates immutable backup and recovery for on-premises, cloud and Microsoft 365 workloads.