Immutable & Protected Backup That Survives Admin Compromise
Immutable and protected backup is a design in which at least one copy of critical data cannot be altered or deleted before its retention expires, even by an administrator, and is held under separate identities and keys from production. NTSPL builds vault locks, logically air-gapped copies, multi-person approval and clean-room restore on AWS, Azure and Google Cloud.
Delivered on
In scope
Designing Backup for an Attacker Who Already Has Admin Rights
Modern ransomware operators spend days inside a network before encrypting anything. Their checklist includes the backup console: they shorten retention, delete recovery points, disable soft delete and remove snapshots, then encrypt production. If the same directory account administers both production and backup, the organisation is left with nothing to restore. Even where copies survive, restoring them straight into a compromised environment, or restoring files already infected weeks earlier, repeats the incident. Indian banks, hospitals and manufacturers have been hit in exactly this sequence.
NTSPL designs protection on the assumption that a production administrator account is already compromised. Critical backups go to a vault whose retention is locked, in an account, subscription or project governed by a separate identity provider or tenant, encrypted with keys the production side cannot use. Destructive actions need a second person. Recovery happens first into a clean-room environment where restored data is scanned and validated before it reaches production. We test the design by playing the attacker in a controlled exercise.
Signals That Your Backups Could Be Deleted in an Attack
Signals you need Immutable & Protected Backup
- The same administrators or directory groups can manage production and delete backups or change retention.
- Backups sit in the same account, subscription or project as production, encrypted with production keys.
- Your cyber-insurance renewal or an RBI, SEBI or IRDAI inspection asks for evidence of immutable or offline backups.
- A peer or supplier was hit by ransomware that deleted backups, and leadership wants proof it cannot happen to you.
- You have no defined process to restore into an isolated environment and scan data before reconnecting production.
When to choose something else
- You do not yet have consistent backup coverage. Fix coverage first through Cloud Backup Architecture; locking an incomplete estate locks in the gaps.
- You need WORM retention for legal records rather than ransomware resilience, such as a document archive with legal holds. That is a storage compliance design, covered under platform storage pages.
- Your main concern is detection of an intrusion. That belongs to security operations and threat detection, though NTSPL links backup anomaly alerts into it.
Protection Layers Built Around Critical Backups
Vault immutability
Retention lock in compliance or locked mode on vaults holding critical copies, with minimum and maximum retention bounds that cannot be shortened.
Identity and tenant isolation
Backup vault account, subscription or project administered by a separate identity group, ideally a separate tenant or organisation unit with its own MFA and break-glass.
Key separation
Customer-managed keys for backup vaults held in the backup account, with key deletion protection and no production principal granted decrypt rights.
Multi-person approval
Destructive or weakening actions, such as disabling soft delete, reducing retention or deleting a vault, require approval from a second, separate administrator.
Backup anomaly detection
Alerts on mass deletion attempts, retention changes, policy removal and unusual restore activity, routed to security operations.
Clean-room recovery
An isolated recovery environment where restored systems are scanned for malware and indicators of compromise and validated before reconnecting.
How Immutable & Protected Backup Works, Step by Step
Isolated Recovery Vault and Clean-Room Restore Design
Production backups are copied to a locked vault in an isolated recovery account with its own identities and keys. In an incident, data is restored into a clean room, scanned and validated, and only then promoted to rebuilt production.
Select any component
Isolated Recovery Vault and Clean-Room Restore Design: click any of its 10 components to see its role and the design choice NTSPL makes for it, or trace the 6-step primary path.
Immutability and Isolation Controls per Provider
Logically air-gapped vaults hold locked copies that can be shared to a separate recovery account through AWS RAM; Vault Lock in compliance mode becomes immutable after its cooling-off period ends.
Locked immutable vaults prevent early deletion; Resource Guard in a separate subscription or tenant requires a second administrator for critical operations such as disabling soft delete.
Backup vaults enforce a minimum retention that backups cannot be deleted before; Bucket Lock makes a Cloud Storage retention policy permanent for object-based backups.
Lock Mode, Isolation and Clean-Room Decisions
Compliance mode or governance mode
Use compliance or locked mode for the copies you depend on for ransomware recovery; no one, including root or global administrators, can shorten retention once locked. Use governance mode, or a not-yet-locked vault, during rollout for 2-4 weeks to verify retention and cost, then lock. Locking a vault with a wrong 10-year retention is irreversible, so model storage cost before locking.
Degree of isolation
Minimum: separate account, subscription or project with its own admin group. Better: separate organisation unit with deny policies blocking production principals. Best: separate identity tenant with its own MFA and break-glass accounts. For banks, hospitals and listed companies, NTSPL recommends the separate-tenant option for the recovery vault, as directory compromise is the most common route to backup deletion.
Choosing recovery points after an attack
Attackers often dwell 10-30 days before encryption. Keep daily locked points for at least 35 days and weekly points for 90 days so you can step back beyond the dwell time. In the clean room, scan from the newest point backwards and pick the newest point without indicators of compromise, rather than defaulting to the latest backup.
Clean-room sizing
Size the clean room for Tier 1 systems only, typically identity, core transaction system and its database. Pre-build the network, scanning tools and a minimal identity service in code so it can be stood up within one to two hours. Keeping it permanently running is rarely needed; test standing it up at least twice a year.
Hardening Backups in Five Stages
Threat model and critical copy selection
Attack paths to backups are mapped and the systems whose copies must survive are selected with security and business owners.
Isolated recovery account and identity
The recovery account, subscription or project is created with separate identity, keys and deny policies against production principals.
Vault copies and pre-lock trial
Copies flow into the new vault in governance mode, before locking, while retention and cost are verified.
Lock, approvals and alerting
Retention is locked, multi-person approval is enabled and backup anomaly alerts are connected to security operations.
Clean-room build and attacker exercise
The clean room is built in code, and a controlled exercise using a simulated compromised admin attempts to delete backups and then recovers a Tier 1 system.
What you receive
Measures of Backup Survivability
| KPI | Typical target |
|---|---|
| Tier 1 systems with a locked copy in an isolated account | 100% |
| Production principals with any role in recovery account | Zero |
| Deletion attempts blocked in attacker exercise | All attempted actions blocked or held for approval |
| Time to stand up clean room | Under 2 hours |
| Time to recover a Tier 1 system via clean room | Measured; typically 4-12 hours including scanning |
Immutability Mistakes and How NTSPL Prevents Them
| Risk | How NTSPL prevents it |
|---|---|
| Locking retention before verifying cost | Vaults run without the lock for a trial period with the full retention ladder, and finance approves the projected cost before the irreversible lock. |
| Recovery account shares an identity provider that is compromised | A separate tenant or at minimum separate admin accounts with phishing-resistant MFA, plus offline break-glass credentials held under dual custody. |
| Restoring an infected recovery point | Clean-room scanning and log review select the newest clean point; restored data never goes back onto old production hosts. |
| Approval fatigue leads to rubber-stamping | Approvals are scoped to rare destructive actions only, with the requester's identity, action and justification shown to the approver. |
Immutable cloud backup vs offline tape: which better protects against ransomware?
Both can be effective if done properly, but locked cloud vaults in an isolated account are now the better default for most Indian enterprises. Tape is truly offline but restores slowly, is hard to test frequently and depends on physical handling and off-site logistics. A locked vault with separate identity and keys cannot be deleted by a compromised admin, restores in hours and can be tested monthly. Keep tape if a regulator or policy requires it, or for very long-term archives. Otherwise, a logically air-gapped cloud copy plus a clean-room process gives faster, more testable recovery.
Key facts: Immutable & Protected Backup
Immutable & Protected Backup in Practice
2 Immutable & Protected Backup scenarios, from Banking (district central cooperative bank) and Media (television and digital newsroom), plus related platform case studies.
Cooperative bank keeps CBS backups out of reach of its own domain admins
News network protects 420 TB of footage and its CMS from a compromised editor account
Multi-specialty hospital cuts HIS recovery time from 2 days to 38 minutes
3PL operator cuts warehouse system recovery time from 2 days to 45 minutes
Immutable & Protected Backup: Frequently Asked Questions
What does an immutable backup design cost?
The build typically takes six to eight weeks and 30-45 consultant days. Run cost is mostly the extra copy's storage in the recovery account, often 30-60% on top of existing backup storage depending on the retention ladder. NTSPL models this before locking, because locked retention cannot be shortened later.
Can the cloud provider delete a compliance-mode backup?
Once a vault lock in compliance mode is in effect, AWS states that the lock becomes immutable and cannot be changed or deleted by any user or by AWS, and recovery points cannot be deleted before retention expires. Azure locked immutable vaults behave similarly. Only retention expiry or account closure ends them.
What do RBI and CERT-In expect on ransomware recovery?
RBI's IT governance and cyber security frameworks expect regulated entities to maintain and test backups and recovery. CERT-In requires cyber incidents, including ransomware, to be reported within 6 hours. A documented clean-room recovery and locked backups give the evidence regulators and insurers ask for after an incident.
Does immutability stop backups being encrypted by ransomware?
It stops existing recovery points from being deleted or altered. New backups taken after encryption will contain encrypted data, which is why you need retention long enough to step back past the attack and anomaly alerts that flag sudden backup size or change-rate jumps.
Should the recovery account be in a different region?
Ideally yes. NTSPL commonly places the locked vault in the second Indian region, such as Hyderabad, South India or Delhi, combining protection against both region loss and admin compromise. Both copies remain in India for data residency. Region separation adds a little inter-region transfer cost.
How do you test without risking real backups?
The attacker exercise uses a dedicated test role granted the same rights a compromised production admin would have, and attempts deletions against test recovery points and policies. It proves blocks and alerts work without touching production copies. Results go into the evidence pack.