Ransomware-Resilient Backups

A ransomware-resilient backup system assumes an attacker may control production hosts and credentials. Its purpose is to keep at least one usable recovery path outside that compromise boundary. Copy creation is only the beginning; isolation, retention, identity, keys, catalogs, detection, and clean restoration determine whether the backup survives an attack.

Production data moves through a controlled backup path to copies in different failure and authority boundaries. Some copies remain online for operational recovery. Another copy is offline, logically isolated, or protected by immutability so production administrators and malware cannot erase every recovery point. A separately protected catalog locates the data, keys decrypt it, and a recovery environment restores it without reintroducing the attacker.

Define the compromise boundary

The compromise boundary contains identities, systems, networks, and management planes an attacker could control together. A backup mounted continuously with production credentials may sit inside that boundary even when it uses separate storage. Resilience begins by drawing who can read, write, expire, delete, replicate, and administer every copy.