Cyber101: What Are Immutable Backups, and Why Are They Important?

A reader asked, “I’m hearing about ‘immutable’ backup. What is that, and why is it becoming so widely advised?” Let’s dive in.

Most of us are familiar with backing up important data. We either manually make a copy of that data on removable media or the cloud, or use software to have it happen automatically. This allows for recovery in the case that the original data is deleted, the machine it’s on is no longer usable, or if it gets encrypted by threat activity like ransomware. Many of us are also familiar with the more common forms of backup operations. Full backups do what their name says - all data that is getting backed up is copied over, regardless of if it had been backed up in the past. Incremental backups copy over only files which have been changed since the last time those files were backed up (or the first time they’re seen if they’re new files). Versioned backups retain one or more previous versions of a file for a specific amount of time after they’ve been changed. The majority of common backup tools available on both consumer and commercial markets will support these backup operation types; and in fact many online storage platforms can do versioned backups these days. Immutable backups don’t change these types of backup operations directly, but rather change how that backed up data can be accessed, deleted, or changed.

With standard backup tools and methods, anyone with the ability to administer the backup system can delete backups, change them, or stop them from happening at all. This is necessary, as keeping very old data that no longer serves any useful purpose (either because it’s no longer being used, or it’s no longer needed for regulatory purposes, etc.) just means additional expense in the form of used storage space.

Immutability is a term used to indicate that something cannot be altered. For example, the past is immutable - nothing that we do can actually change events that have already occurred. In backup technology, immutability means that the data which has been backed up cannot be altered or deleted by anyone except under incredibly specific circumstances. While it is possible to delete an immutable backup, it requires significant levels of administrative authority, and also typically will be time-gated so that the delete operation doesn’t happen for a period of time (e.g. 30 days). This gives backed up data a form of permanence beyond what more traditional backup systems can offer.

The reason immutable backups are important is that threat actors have realized that - with enough time and skill - they can corrupt and/or encrypt the backup copies of critical organizational data. Doing so means that the organization cannot restore from those backups, which increases the chance that the organization will pay the ransom the threat actors are demanding to decrypt all the data they’ve encrypted. Threat actors who are financially motivated (which are currently in the majority) are definitely working to do everything they can to ensure they receive ransom payouts, and so corrupting or encrypting backups is becoming a key component of modern ransomware attacks.

Immutable backups do have a drawback, however - storage space and the costs associated with it. Because the backups never get deleted except under specific and highly controlled circumstances, pruning backups (removing older/outdated backup copies) to conserve storage space in cloud systems or external storage platforms is not something you can regularly perform with immutable backup systems. Therefore, it’s necessary to allocate much more storage space in whatever platform you’ll use to store the backups, and that means that more budget will have to be applied in order to pay for the additional storage costs. Additionally, the nature of immutable backup solutions also means that extra time has to be spent to manage the backup processes. Pruning is still required, but has to be properly authorized (which is a multi-step and multi-administrator process), and then scheduled 30 days or more in advance. As the pruning window comes around to the present day, additional multi-step/multi-administrator processes have to be performed to authorize the final deletion of the data. While cumbersome, these steps are required to ensure that only the organization’s authorized administrators can ever delete the data - and even then they must work within strict safeguards to ensure it’s not deleted accidentally or by a rogue administrator. Finally, immutable backup solutions do typically cost more than standard backup tools. The price difference is variable depending on the vendor, but in most cases it requires holding the immutable backups in vendor cloud platforms and/or on vendor-provided appliances and storage, so the cost difference can be significant.

In summary, immutable backups are a valuable component of the modern ransomware recovery technique landscape. The nature of how they work may make it fiscally or operationally difficult for many companies to implement them, but organizations which have the staff and budget necessary should absolutely bring immutability into their backup tool-kit.

About the Author:

Michael DeNapoli is a seasoned Senior Solutions Architect with more than 25 years of experience in cybersecurity, solution architecture, and enterprise systems design. Throughout his career, he has led technical strategy, security architecture, and advanced solution development for organizations ranging from emerging security vendors to global enterprises. Michael’s expertise spans cybersecurity operations, cloud architecture, technical sales leadership, security posture management, and identity protection, with a proven track record of guiding clients through complex technology challenges. Today, he brings his deep industry knowledge to Pondurance as a Senior Solutions Architect, helping organizations strengthen their security foundations with clarity and confidence.