Modern ransomware groups do not start by encrypting your servers. They start by finding your backups and deleting them. If they succeed, paying the ransom becomes the only way back. Immutable backups are designed to stop exactly that.
What Immutable Means
An immutable backup is locked for a set number of days. During that time nobody can change it or delete it, not even an administrator with full rights. When the lock expires, normal retention rules take over.
Encryption and immutability solve different problems. Encryption stops someone from reading your data. Immutability stops someone from destroying it. A good design uses both.
How It Works With Veeam
Veeam Backup and Replication supports immutability in two main ways:
- A Veeam Hardened Repository: a Linux server that marks backup files as immutable using the file system's immutable attribute (Veeam recommends XFS). It is added with single-use credentials that Veeam does not store, and Veeam advises disabling SSH once it is set up.
- Object storage with Object Lock: S3-compatible storage, on premises or in the cloud, where each backup object is locked by the storage itself.
Many designs use both: a hardened repository on site for fast restores, and a locked copy in object storage off site.
Lock the Doors Around It
Immutability protects the backup files. You also need to protect the systems that manage them:
- Keep the backup server out of your normal Active Directory domain, or in a separate, hardened one.
- Use separate accounts for backup administration, with multi-factor authentication.
- Limit network access to the backup server and repositories to what they really need.
- Keep Veeam and the repository operating system patched.
The 3-2-1-1-0 Rule
A simple way to check your design is the 3-2-1-1-0 rule: three copies of your data, on two different types of media, one copy off site, one copy offline or immutable, and zero errors when you test a restore.
Test the Restore
A locked backup that does not restore is still a failed backup. Veeam SureBackup can start VMs from backup in an isolated lab and check that they boot and run. We schedule these tests so you have regular proof, not just green backup jobs.
How Long Should the Lock Be?
Attackers often sit inside a network for days or weeks before they strike. If your lock lasts only 7 days, an attacker who waits 10 days can still reach copies that are no longer locked. Many businesses choose 14 to 30 days for the locked copy, balanced against the storage it uses. Longer retention can sit on cheaper storage.
Common Questions
Is a Cloud Backup Automatically Immutable?
No. A copy in the cloud is off site, but unless Object Lock or a similar feature is switched on, anyone with the right credentials can still delete it.
Does Immutability Replace Antivirus and Patching?
No. It is the last line, used when everything else has failed. Prevention still matters, and so does a tested plan for who does what during an attack.
A Quick Checklist
- At least one copy of every critical backup is immutable
- Immutability period is longer than the time an attacker may stay hidden
- Backup servers use separate accounts with MFA
- One copy is stored off site
- Restores are tested on a schedule and the results are recorded
How We Help
We design and build Veeam backup with immutability end to end: hardened repositories, object storage with Object Lock, access controls and scheduled restore tests. If you already run Veeam, we can review your setup and close the gaps.
