Implement secure backups

All information and examples in this article are implementation recommendations for secure backups.

Nothing here is contractually binding.

Backups are your last line of defense during ransomware and destructive attacks.

Recovery success depends on backup quality, frequency, retention, and the ability to restore quickly.

Conditions for Stoik cyber insurance

Stoïk cyber insurance sets backup requirements during underwriting.

Minimum requirement: at least one weekly backup must be:

• offline, or

• on immutable storage

With a minimum retention of 2 weeks.

If offline or immutable is not possible, a less recommended option is a secure online backup.

The backup system stays connected, but must meet all requirements below:

• Backup system is outside the AD domain

• Backup system is segmented (firewall + allowlist access)

• Backup deletion/modification is only possible via a web console protected by MFA

Goal: even with a compromised domain admin or cloud admin, an attacker still cannot wipe backups.

Backup types (and what counts)

Type	Typical examples	Why it matters	Meets the requirement?
Offline backups	External drives, USB media, offline NAS, magnetic tapes (LTO/DLT)	Highest protection. Not reachable over the network.
Immutable online backups (cloud)	AWS S3 Object Lock, Azure immutable blobs (WORM), Wasabi Object Lock	Reachable online, but cannot be altered or deleted.
Online backups (on‑prem / data center)	Dedicated backup server with restricted access	Can be acceptable only if access is strongly isolated.	(only if hardened)
Non‑immutable online “storage” (cloud)	Dropbox, Google Drive, OneDrive without WORM	Easy to use, easy to delete if accounts are compromised.
Local backups	Local disks, file copy on the same server, RAID mirroring	Gets encrypted or deleted with the host. Not a recovery plan.

“Secure online backup” means “resilient against a typical ransomware playbook that tries to delete all backups”.

Offline backup options

Use rotation. Keep at least one recent copy disconnected.

Option	How to do it safely
Magnetic tapes (LTO/DLT)	Rotate at least 2 tapes. Keep 1 tape offsite/offline at all times.
Offline NAS	Connect only for the backup window. Disconnect after the job. Rotate multiple devices if possible.
External drives / USB media	Connect only for the backup window. Disconnect after the job. Store in a locked location. Rotate multiple devices.

Immutable backup options

Cloud-hosted immutable backups

Provider	Immutability feature	Guide / docs
AWS	S3 Object Lock (and/or Glacier)	Immutable S3 backups
Azure	Immutable blobs (WORM)	Cloud backup solutions
Wasabi	S3 Object Lock	Back up your data with Wasabi
Acronis Cyber Protect Cloud	Compliance mode (check your plan/version)	Acronis docs 1, Acronis docs 2
Scaleway	Object Storage (check Object Lock support)	Scaleway Object Storage concepts
OVHcloud	Object Lock for S3 Object Storage	OVHcloud guide
Fast LTA	“Zero Loss Storage”	Fast LTA overview

Locally hosted immutable backups

Provider / product	Prereqs	Guide / docs
Veeam Linux Hardened Repository	Veeam >= 11. Requires hardening of the repository host.	Veeam reference
Synology	DSM >= 7.2. Requires supported models.	Supported models, Immutable snapshot docs
Dell Data Domain	Use compliance mode.	Dell paper

Examples of “unsecured” backups

These are common patterns that fail when attackers take over admin accounts.

Example	Why it fails
Dropbox / Google Drive / OneDrive / SharePoint (no WORM)	A compromised admin can delete data and also purge recycle bins / retention.
“Immutable” NAS implemented only in software	If the NAS OS is compromised, the attacker can still destroy volumes.
Outsourced data center with a permanent network link	Functionally similar to an online file server. Ransomware can encrypt/delete over the link.
Non-immutable cloud storage	If the cloud admin is compromised, the attacker can delete buckets, backups, and retention rules.

Operational controls (recommended)

Even with offline/immutable storage, operational controls often decide recovery success:

• Test restores on a schedule (at least monthly for critical systems).

• Use separate backup admin accounts. Do not sync them from AD.

• Enforce MFA on backup consoles and cloud accounts.

• Keep backup credentials out of user endpoints (no saved passwords in scripts).

• Enable alerting on backup job failures, retention changes, and deletion attempts.

• Document the restore runbook and keep a copy offline.