Immutable Backup Package

Why This Is Loop 0

How Attackers Kill Your Backups

Entry Point: Backup Resilience Assessment

Assessment Checklist

• Backup existence: What's backed up? What isn't? Is M365 data backed up or just relying on retention policies?
• Immutability check: Can a domain admin delete your backups right now? If yes, they're not immutable.
• Credential separation: Are backup admin credentials the same as domain admin? Same password? Same MFA?
• Network isolation: Is backup infrastructure on the same VLAN/subnet as production? Can ransomware on a workstation reach the backup server?
• Restore test: Pick a critical system. Actually restore it. Time it. Compare against your stated RTO. Any RTO claim that hasn't been validated by a timed restore is fiction.
• Retention depth: How far back can you restore? Dwell time can be 14+ days — if your oldest backup is 7 days, you're restoring to a compromised state.
• M365 backup: Are Exchange, SharePoint, Teams, OneDrive backed up independently? Native retention policies are NOT backup.

Output

Backup resilience scorecard: what's protected, what's immutable, what's tested, what's the actual (not theoretical) RTO. Insurance gap analysis for backup controls specifically.

• Change backup admin passwords to something unique — not shared with domain admin, not in a password vault that's on the domain
  30 minFree
• Enable MFA on backup admin accounts — separate MFA from production MFA (different authenticator app or hardware key)
  30 minFree
• If using cloud backup, check that API keys have minimum permissions — write-only for backup agents, separate admin key for restore/delete
  1 hourFree
• Disable the ability to delete backup jobs from the backup management console without separate authorization
  30 minFree
• Create a manual offline copy of the most critical data right now — external USB drive, locked in a safe. Ugly but air-gapped.
  2 hours~Free
• Dump databases before backing up — backing up running DB volumes risks corruption. Add pg_dump / mysqldump pre-backup hooks.
  1 hourFree

• Credential audit: Map every account that can access, modify, or delete backup data. Ensure zero overlap with domain admin accounts.
• Immediate S3 Object Lock: If backups go to S3-compatible storage, enable Object Lock in Governance mode today (can upgrade to Compliance mode after validation).
• Network isolation: Move backup server to a separate VLAN if possible. At minimum, restrict inbound access to only the backup agents.

Zero shared credentials between production and backup. Backup infrastructure unreachable from compromised workstations. Immediate offline copy exists for worst-case scenario.

• Alert on VSS shadow copy deletion — Windows Event ID 8225 or Sysmon process create for vssadmin.exe delete
  30 minFree
• Alert on backup service stop/disable — Windows Event ID 7036 for backup agent service state changes
  30 minFree
• Alert on backup job failures — most backup tools can email on failure. Enable it. Check the email account is monitored.
  15 minFree
• Monitor backup storage capacity — sudden drops in backup size may indicate deletion. Sudden spikes may indicate encryption of source data.
  30 minFree

• Wazuh rules for backup integrity: FIM on backup config files, alerts on backup credential access, process monitoring for shadow copy deletion tools
• Canary files in backup repos — if a canary file disappears from backup, someone is tampering
• Backup completion dashboard — single pane showing: last successful backup per system, backup size trend, any failed jobs

Any attempt to delete, modify, or disable backups generates an immediate alert. Backup health visible at a glance. No silent failures.

• Install Kopia or Restic — free, encrypted, deduplicated backups with S3 Object Lock support
  2 hoursFree / OSS
• Set up BorgBackup in append-only mode on a Linux server — clients can create archives, cannot delete
  4 hoursFree / OSS
• Configure backup credentials as write-only / append-only — the backup agent can push data but cannot delete or modify existing backups
  1 hourFree

• Primary backup: Kopia or Restic to on-prem storage (MinIO with Object Lock, or NAS with WORM snapshots). Fast restores.
• Secondary backup: Replicate to cloud with S3 Object Lock Compliance mode (Wasabi $6.99/TB or Backblaze B2 $6/TB). Geographic redundancy.
• Tertiary backup (optional): Quarterly LTO tape or disconnected USB rotation to physical safe. True air gap for catastrophic scenarios.
• Backup VLAN: Dedicated network segment for backup infrastructure. No inbound access from workstations. Firewall rules restrict traffic to backup agents only.
• Separate credentials: Backup admin accounts not in AD. Different passwords, different MFA. Stored in a separate password manager or physical safe.
• Retention policy: Minimum 30 days for daily backups (covers typical dwell time). 90 days for weekly. 1 year for monthly. Retention MUST exceed typical attacker dwell time (14+ days).
• Pre-backup hooks: Database dumps (pg_dump, mysqldump) before filesystem backup. Never back up running database files directly.

Reference Architecture (200 seats)

[200 Endpoints + Servers]
        |
        | (kopia/restic client, write-only credentials)
        v
[Backup Server: kopia server / restic-rest-server --append-only]
   (Dedicated VLAN, no domain join, separate admin creds)
        |
        +--> [Primary: MinIO on-prem, Object Lock Compliance]
        |         (fast restore, on-site)
        |
        +--> [Secondary: Wasabi/B2, Object Lock Compliance]
        |         (geographic redundancy, offsite)
        |
        +--> [Tertiary: LTO tape / USB in safe]
                  (true air gap, quarterly rotation)

3-2-1-1 fully implemented. Primary on-prem for fast restore. Secondary cloud for geographic redundancy. Both with Object Lock Compliance — even root can't delete within retention. Backup infrastructure on isolated VLAN with separate credentials.

• Set a monthly calendar reminder: restore one random file per backed-up system. Verify checksum.
  5 minFree
• Check backup storage capacity trend — is it growing as expected or has it plateaued (indicating silent failure)?
  15 min/monthFree
• Verify backup admin credentials still work — and that they're still separate from domain admin
  10 min/monthFree

Monthly file restores passing. Quarterly full-app restores validating RTOs. Annual DR simulation documenting actual recovery time. Adversarial testing confirming immutability holds under attack.

• Write the Recovery Priority List: Tier 0 (AD/identity — nothing works without this), Tier 1 (payroll — almost always #1 for employees), Tier 2 (ERP/core business), Tier 3 (everything else). Email it to IT and management.
  1 hourFree
• Print the backup admin credentials and store in a physical safe (not in the password manager that might be encrypted)
  15 minFree

• DR runbook: Step-by-step recovery per tier. Named roles. Tested quarterly. Action cards on laminated paper, not a 60-page PDF on the encrypted file server.
• M365 backup solution: Native retention is NOT backup. Deploy commercial M365 backup (~$2–4/user/month) for Exchange, SharePoint, Teams, OneDrive with independent retention.
• Immutable infrastructure: Where possible, rebuild from code/image rather than restore from backup. Infrastructure-as-code for servers means faster reprovisioning.
• Insurance evidence package: Document immutable backup architecture, retention policies, restore test results, credential separation. This is the evidence that gets claims approved.
• NIS2 Article 21 alignment: Backup management and disaster recovery are explicitly mandated. Documented 3-2-1-1 + tested DR plan = compliance artifact.
• Board reporting: Quarterly backup health report: systems covered, last successful backup, last tested restore, RTO status, immutability status. One page.
• Separate management AD (Red Forest): All privileged accounts (backup admin, hypervisor admin, network admin) live in a separate AD forest. Production domain trusts management domain (one-way) — management admins can manage production resources, but production cannot query the management domain. Attackers who compromise production AD cannot see who the admins are, where they live, or target them. net group "Domain Admins" /domain on production returns nothing useful — the real admins don't exist in that directory. BloodHound against production can't map the attack path. Kerberoasting and NTDS.dit extraction yield zero management credentials. The admins are invisible to reconnaissance.
• Log retention architecture: 365 days on every server. Increase Windows Event Log to 1GB+ per channel (Security, System, PowerShell). Linux syslog: 12 months. Forward to central logging on isolated infrastructure AND keep on-host copies — if central logging is compromised, on-host logs are your forensic backup. 1TB disk costs less than a coffee per day.

Recovery is a tested, documented, practiced process — not a hope. Admin accounts invisible to attackers via management AD. Logs retained 365 days. Any scenario (ransomware, insider, failed patch, supply chain compromise) has a recovery path with a validated RTO. Insurance approved. NIS2 compliant. Board informed.

Program Economics (200-seat reference, 50TB data)

Ongoing Storage Costs

What "Tested" Actually Means