Implementing Ransomware Backup Strategy

When to Use

• Designing backup architecture that withstands ransomware encryption and deletion attempts
• Migrating from traditional backup to ransomware-resilient backup with immutable storage
• Establishing RPO/RTO targets for critical systems and validating them through restore testing
• Isolating backup credentials and infrastructure from the production Active Directory domain
• Meeting cyber insurance requirements for backup resilience and tested recovery capabilities

Do not use as a substitute for endpoint protection, network segmentation, or incident response planning. Backups are a last line of defense, not a primary prevention control.

Prerequisites

• Inventory of critical systems, applications, and data classified by business impact (Tier 1/2/3)
• Defined RPO (Recovery Point Objective) and RTO (Recovery Time Objective) per tier
• Backup software supporting immutable repositories (Veeam 12+, Commvault, Rubrik, Cohesity)
• Isolated backup network segment or air-gapped storage infrastructure
• Separate backup admin credentials not joined to the production AD domain

Workflow

Step 1: Classify Assets and Define Recovery Objectives

Map all systems into recovery tiers based on business impact:

Document dependencies between systems. Domain controllers and DNS must recover before application servers. Database servers before application tiers.

Step 2: Implement 3-2-1-1-0 Architecture

Configure backup storage following the extended 3-2-1-1-0 rule:

Copy 1 - Primary backup on local storage:

# Veeam backup job targeting local repository
# Fast restore for operational recovery
Backup Repository: Local NAS (CIFS/NFS) or SAN
Retention: 14 days of restore points
Encryption: AES-256 with password not stored in AD

Copy 2 - Secondary backup on different media:

# Replicate to secondary site or cloud
# Veeam Backup Copy Job or Scale-Out Backup Repository
Target: AWS S3 / Azure Blob / Wasabi / tape library
Retention: 30 days
Transfer: Encrypted TLS 1.2+ in transit

Copy 3 - Offsite copy:

# Geographically separated from primary and secondary
# Cloud object storage in different region or physical tape rotation
Target: Cross-region cloud storage or Iron Mountain tape vaulting
Retention: 90 days

+1 - Immutable or air-gapped copy:

# Cannot be modified or deleted for defined retention period
# Veeam Hardened Repository on Linux with immutable flag
# Or AWS S3 Object Lock in Compliance mode
# Or physical air-gapped tape

+0 - Zero errors on restore verification:

# Automated restore testing using Veeam SureBackup or equivalent
# Scheduled weekly for Tier 1, monthly for Tier 2/3
# Verify boot, network connectivity, and application health

Step 3: Isolate Backup Credentials

Ransomware operators target backup infrastructure by compromising backup admin credentials through Active Directory:

1. Separate backup admin accounts from the production AD domain. Use local accounts on backup servers or a dedicated backup management domain.
2. Dedicated backup network segment with firewall rules allowing only backup traffic (specific ports, specific source/destination IPs).
3. MFA on backup console access using hardware tokens or authenticator apps, not SMS.
4. Disable RDP on backup servers. Use out-of-band management (iLO/iDRAC/IPMI) for emergency access.
5. Remove backup servers from domain or place in a dedicated OU with restricted GPO inheritance.

# Linux Hardened Repository - disable SSH password auth
sudo sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

# Set immutable flag on backup files (XFS filesystem)
sudo chattr +i /mnt/backup/repository/*

# Veeam Hardened Repository uses single-use credentials
# that are not stored on the Veeam server after initial setup

Step 4: Configure Immutable Storage

Veeam Hardened Linux Repository:

…