Backup Is Not a Cybersecurity Strategy: Immutable Storage & Recovery Concepts
“We run backups every day.” This statement puts many executives at ease. The uncomfortable truth: Ransomware attacks now systematically encrypt backup systems as well. Anyone without immutable storage and tested recovery processes is in for an unpleasant surprise when disaster strikes.
The 3-2-1-1-0 Rule: What Modern Backup Means
The classic 3-2-1 rule will no longer suffice in 2026. The expanded 3-2-1-1-0 rule defines the current standard:
- 3 copies of the data
- 2 different storage media
- 1 copy stored off-site (offsite or in the cloud)
- 1 copy that is offline or immutable
- 0 errors during restoration – verified through regular testing
Air Gap vs. Immutable Storage
Air-gapped backups are physically disconnected from the network. Ransomware cannot reach them. Downside: Recovery takes longer.
Immutable storage is accessible over the network, but is technically secured in such a way that stored data cannot be modified or encrypted for a defined period of time—not even by ransomware or compromised administrator credentials.
RTO and RPO: What Companies Really Care About
- RTO – Recovery Time Objective: How long should the recovery take? What is the cost of each hour of downtime?
- RPO – Recovery Point Objective: How much data loss can be tolerated?
These questions must be addressed jointly by the IT department and senior management before the attack.
Common misconceptions
- “Ransomware only encrypts production data”—wrong; backup systems are being specifically targeted
- “Our cloud provider handles backups”—Cloud providers back up their infrastructure, not your data
- “We test the backup once a year”—too infrequently given the current threat landscape
What Companies Need to Do Now
- Implement the 3-2-1-1-0 rule: use an immutable or offline copy as the default
- Conduct and document recovery tests at least quarterly
- Disconnect backup systems from the production network – use your own credentials
- Set up backup monitoring: Alerts for failed backups
Axsos analyzes your backup infrastructure and develops a strategy tailored to your business needs. Request a backup assessment now.