Ransomware operators learned long ago that the fastest way to force a payment is to destroy the victim's ability to recover. That means backups are not a side target; they are a primary one.
Protecting a recovery copy is therefore less about backup software features and more about reachability. If the backup repository can be reached from a compromised network, it can be encrypted or deleted. The goal is to keep at least one copy genuinely out of reach.
01Key takeaways
- 01
Modern ransomware deliberately seeks out and destroys backups before encrypting production, so a reachable backup is a vulnerable backup.
- 02
The 3-2-1 strategy and immutability are necessary but not sufficient if the repository is continuously reachable.
- 03
One-way replication moves backup data outward without giving the destination a path back into the protected environment.
- 04
Time-based disconnection keeps the repository offline except during the backup window, shrinking the time it can be attacked.
- 05
Recovery assurance requires testing restores from the protected copy, not just confirming that backups ran.
02Why backups are the target
Recovery is the defender's leverage in a ransomware incident. If an organization can restore quickly, the pressure to pay collapses. Attackers know this, so they spend time locating and destroying backups before triggering encryption.
Guidance from CISA's #StopRansomware program and others consistently emphasizes maintaining offline, encrypted backups precisely because online backups share the fate of the network they sit on.
A backup an attacker can reach is a backup an attacker can ruin. Reachability, not backup software, is usually the deciding factor.
03How ransomware follows the path back
Backups are often connected to production for convenience: the backup server mounts shares, holds credentials, or sits on a reachable segment. Each of these is a path an attacker can follow from a compromised host to the repository.
- Shared credentials that let a compromised host authenticate to the backup system.
- Network routes that allow a foothold to reach the repository directly.
- Backup agents or consoles exposed on segments an attacker can move through.
- Replication links that carry traffic in both directions, giving the destination reachability too.
The common thread is a two-way relationship between production and the backup copy. Breaking that relationship is the most reliable protection.
04Foundations: 3-2-1, immutability, isolation
- 3-2-1
- Keep at least three copies of data, on two different media, with one copy off-site or otherwise separated.
- Immutability
- Store backups so they cannot be altered or deleted for a retention period, defending against tampering even if the system is reached.
- Isolation
- Ensure at least one copy is not reachable from production, so a compromise of the network does not automatically compromise the copy.
Immutability and isolation reinforce each other. Immutability resists tampering; isolation reduces the chance the attacker ever reaches the copy to attempt it.
05One-way replication of backup data
One-way replication moves backup data from production to a protected repository across a boundary that enforces direction. The production side can push data outward, but the repository cannot be reached back through that path.
This directly breaks the two-way relationship attackers rely on. Even with stolen credentials and a foothold, there is no network route from the compromised side into the protected copy through the replication channel.
06Time-based disconnection of the repository
One-way replication can be combined with, or replaced by, keeping the repository physically disconnected except during the backup window.
An AIRGAPNET controlled connectivity device can hold a physical break in front of the backup repository and reconnect it only for the approved backup job, then disconnect it again. Outside the window the repository is not reachable from any network, which removes it as a target for most of the week.
Because the connect and disconnect is driven out of band, an attacker on the production network cannot force the repository to stay online.
07Recovery assurance: test the restore
Protection is only proven by recovery. A backup that exists but cannot be restored is not a recovery capability.
- Test restores from the protected copy on a regular schedule, not just backup completion.
- Verify integrity of the protected copy so corruption is detected before it is needed.
- Document recovery time from the isolated copy so expectations are realistic during an incident.
- Keep credentials and recovery tooling for the protected copy separate from production identity.
08Closing thought
The hard question in ransomware resilience is not whether backups exist; it is whether at least one copy is out of reach when the network is compromised. Immutability helps, but isolation by one-way transfer or physical disconnection is what removes the copy from the attacker's path.
Design the backup relationship so that production can write to the copy but never reach it, and the most valuable thing you own during an incident stays intact.
FAQFrequently asked questions
Why does ransomware target backups?
Recovery is the defender's leverage. If an organization can restore quickly, the pressure to pay collapses, so attackers locate and destroy backups before triggering encryption. A reachable backup shares the fate of the network it sits on.
Are immutable backups enough to stop ransomware?
Immutability resists tampering and is important, but it is not sufficient on its own if the repository is continuously reachable. Combining immutability with isolation, through one-way replication or disconnection, is far stronger.
How does one-way replication protect backups?
One-way replication pushes backup data to a protected repository across a boundary that enforces direction. The production side can write outward, but a compromised host cannot reach the protected copy back through that channel.
How does time-based disconnection help backups?
Keeping the repository physically disconnected except during the backup window means it is not reachable from any network most of the time. Driving the disconnection out of band prevents an attacker from forcing it to stay online.
What is the 3-2-1 backup strategy?
3-2-1 means keeping at least three copies of data on two different media with one copy off-site or otherwise separated. It is a foundation that becomes much stronger when at least one copy is genuinely isolated from production.
SRCSources of record
Keep one copy out of reach
Let production write to the backup, never reach it.
Combine immutability with one-way replication or time-based disconnection so at least one recovery copy stays off the attacker's path when the network is compromised.