> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/cyber-best-practices/harden-your-environment/readme.md).

# Implement secure backups

{% hint style="info" %}
All information and examples in this article are implementation recommendations for secure backups.

Nothing here is contractually binding.
{% endhint %}

Backups are your last line of defense during ransomware and destructive attacks.

Recovery success depends on backup quality, frequency, retention, and the ability to restore quickly.

### Conditions for Stoik cyber insurance

Stoïk cyber insurance sets backup requirements during underwriting.

Minimum requirement: **at least one weekly backup** must be:

* **offline**, or
* on **immutable storage**

With a **minimum retention of 2 weeks**.

If offline or immutable is not possible, a less recommended option is a **secure online backup**.

The backup system stays connected, but must meet **all** requirements below:

* Backup system is **outside the AD domain**
* Backup system is **segmented** (firewall + allowlist access)
* Backup deletion/modification is only possible via a **web console protected by MFA**

Goal: even with a compromised domain admin or cloud admin, an attacker still cannot wipe backups.

### Backup types (and what counts)

| Type                                   | Typical examples                                                     | Why it matters                                                | Meets the requirement?                                                     |
| -------------------------------------- | -------------------------------------------------------------------- | ------------------------------------------------------------- | -------------------------------------------------------------------------- |
| Offline backups                        | External drives, USB media, offline NAS, magnetic tapes (LTO/DLT)    | Highest protection. Not reachable over the network.           | <i class="fa-check" style="color:$success;">:check:</i>                    |
| Immutable online backups (cloud)       | AWS S3 Object Lock, Azure immutable blobs (WORM), Wasabi Object Lock | Reachable online, but cannot be altered or deleted.           | <i class="fa-check" style="color:$success;">:check:</i>                    |
| Online backups (on‑prem / data center) | Dedicated backup server with restricted access                       | Can be acceptable **only if** access is strongly isolated.    | <i class="fa-check" style="color:$success;">:check:</i> (only if hardened) |
| Non‑immutable online “storage” (cloud) | Dropbox, Google Drive, OneDrive without WORM                         | Easy to use, easy to delete if accounts are compromised.      | <i class="fa-xmark" style="color:$danger;">:xmark:</i>                     |
| Local backups                          | Local disks, file copy on the same server, RAID mirroring            | Gets encrypted or deleted with the host. Not a recovery plan. | <i class="fa-xmark" style="color:$danger;">:xmark:</i>                     |

**“Secure online backup”** means “resilient against a typical ransomware playbook that tries to delete all backups”.

### Offline backup options

Use rotation. Keep **at least one** recent copy disconnected.

| Option                      | How to do it safely                                                                                                |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------ |
| Magnetic tapes (LTO/DLT)    | Rotate at least 2 tapes. Keep 1 tape offsite/offline at all times.                                                 |
| Offline NAS                 | Connect only for the backup window. Disconnect after the job. Rotate multiple devices if possible.                 |
| External drives / USB media | Connect only for the backup window. Disconnect after the job. Store in a locked location. Rotate multiple devices. |

### Immutable backup options

#### Cloud-hosted immutable backups

| Provider                    | Immutability feature                                                                                 | Guide / docs                                                                                                                                  |
| --------------------------- | ---------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| AWS                         | [S3 Object Lock](https://aws.amazon.com/s3/features/object-lock/) (and/or Glacier)                   | [Immutable S3 backups](broken://pages/5038aaaf580026f389c58962ca6809e3673e136a)                                                               |
| Azure                       | [Immutable blobs (WORM)](https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview) | [Cloud backup solutions](broken://pages/2c353ea7170353104cce66b23e6fac6e5a0b8e2c)                                                             |
| Wasabi                      | [S3 Object Lock](https://wasabi.com/cloud-object-storage/s3-object-lock)                             | [Back up your data with Wasabi](broken://pages/ec582c4e223d151920df98c99e711378950dec7b)                                                      |
| Acronis Cyber Protect Cloud | Compliance mode (check your plan/version)                                                            | [Acronis docs 1](https://kb.acronis.com/content/69814), [Acronis docs 2](https://kb.acronis.com/content/71557)                                |
| Scaleway                    | Object Storage (check Object Lock support)                                                           | [Scaleway Object Storage concepts](https://www.scaleway.com/en/docs/storage/object/concepts/)                                                 |
| OVHcloud                    | Object Lock for S3 Object Storage                                                                    | [OVHcloud guide](https://help.ovhcloud.com/csm/en-public-cloud-storage-s3-managing-object-lock?id=kb_article_view\&sysparm_article=KB0047399) |
| Fast LTA                    | “Zero Loss Storage”                                                                                  | [Fast LTA overview](https://www.fast-lta.de/en/topic/zero-loss)                                                                               |

#### Locally hosted immutable backups

| Provider / product              | Prereqs                                                 | Guide / docs                                                                                                                                                                                                             |
| ------------------------------- | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Veeam Linux Hardened Repository | Veeam >= 11. Requires hardening of the repository host. | [Veeam reference](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-veeam-cr-sa-lhr)                                                                                                                      |
| Synology                        | DSM >= 7.2. Requires supported models.                  | [Supported models](https://kb.synology.com/DSM/tutorial/which_synology_nas_models_support_WriteOnce_and_secure_snapshots), [Immutable snapshot docs](https://kb.synology.com/DSM/tutorial/what_is_an_immutable_snapshot) |
| Dell Data Domain                | Use compliance mode.                                    | [Dell paper](https://education.dell.com/content/dam/dell-emc/documents/en-us/2020KS_Steen_Immutable_Data_Protection_for_Any_Application.pdf)                                                                             |

### Examples of “unsecured” backups

These are common patterns that fail when attackers take over admin accounts.

| Example                                                  | Why it fails                                                                                      |
| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
| Dropbox / Google Drive / OneDrive / SharePoint (no WORM) | A compromised admin can delete data and also purge recycle bins / retention.                      |
| “Immutable” NAS implemented only in software             | If the NAS OS is compromised, the attacker can still destroy volumes.                             |
| Outsourced data center with a permanent network link     | Functionally similar to an online file server. Ransomware can encrypt/delete over the link.       |
| Non-immutable cloud storage                              | If the cloud admin is compromised, the attacker can delete buckets, backups, and retention rules. |

### Operational controls (recommended)

Even with offline/immutable storage, operational controls often decide recovery success:

* **Test restores** on a schedule (at least monthly for critical systems).
* Use **separate backup admin accounts**. Do not sync them from AD.
* Enforce **MFA** on backup consoles and cloud accounts.
* Keep **backup credentials** out of user endpoints (no saved passwords in scripts).
* Enable **alerting** on backup job failures, retention changes, and deletion attempts.
* Document the restore runbook and keep a copy **offline**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/cyber-best-practices/harden-your-environment/readme.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.