What is Immutable Backup? Immutable Backups as a Data Security Measure

Introduction

Data permanence as a general idea is not something new or groundbreaking, it has been around for an undetermined number of years in many different iterations. Cave paintings are widely considered one of the first, if not the first, case of data permanence – with humans wanting to retain specific information for a prolonged time period. As for how the modern world perceives permanent data, there is a specific definition for it – immutable backups.

Digital information nowadays is one of the most important resources any company could have, and the same could be said about non-commercial environments, from personal digital lives to entire governments – information is everything. This is why data security became so important in recent years, and its importance is hard to overestimate at this point.

Immutable backup and why it is necessary

As such, there are plenty of different approaches to data security, one of which implies important data that, once created, cannot be modified in any way, shape, or form. This kind of data is what is commonly known as an immutable backup – a copy of valuable information that cannot be altered whatsoever once created, serving as a dedicated restoration option for production servers and other company resources in case something unexpected happens with existing data.

There are plenty of different ways to render important data inoperable, with ransomware being one of the most “popular” ones. Ransomware is a variation of malware that prevents the user from accessing their data unless the user in question pays a monetary sum for the unlock or the decryption key – which is where the “ransom” part comes in.

Since ransomware can target the majority of devices that are capable of accessing the Internet and has a very problematic pattern of being able to spread throughout the entire system in no time, it is easy to see why ransomware as a security issue is so high on everyone’s priority list right now. That’s not to say that other methods of a data breach are harmless – but ransomware serves as a great main example of how a company’s data can be encrypted or corrupted in an extremely small time frame.

Another part of this problem is that a lot of different methods that cybercriminals use to access sensitive information tend to evolve at a terrifying pace. In fact, there are already plenty of different ransomware examples that also know to search for and target backups that could be used to restore encrypted data – rendering most traditional data recovery methods useless or at least far less secure.

There is a rather clear separation between primary storage and backups, in which the former has to be open to client systems to allow for collaboration and general work operations, while the latter should be as secure, isolated, and immutable as possible to ensure data recovery in case their original data is compromised in one way or another.

At the same time, it is rather hard to imagine something more secure than an immutable backup copy – since more standard security measures such as storage protocols or file permissions can still be circumvented in some way or another. As such, immutable backups are basically a requirement for any competent data security system in the modern day. Other advantages of immutable backup include easier versioning and easier data compliance – offering accurate copies of data from specific time frames.

Why immutable backups are not enough?

Despite the fact that the existence of an immutable backup in any company’s backup and recovery strategy right now is practically a requirement, these backups alone are not enough to ensure a proper level of recoverability. First of all, there are little to no data security experts that advise paying ransom whenever your company is struck with ransomware. The biggest reason for that is the track record of attackers actually providing decryption keys once the ransom has been paid is more or less nonexistent, and decryption itself is a long and complicated process.

There are also plenty of other factors in place. A rather classic case of an immutable backup is a WORM system (Write Once Read Many) that renders the data immune to any modification once it has been created. There are no exceptions to the modification restriction, the data in question can only be copied to an internal system (any external access is prohibited), and there is a very short list of APIs or services that are permitted to do so.

This exact approach already has at least one weak link to it – a list of trusted services of APIs, and there are all kinds of exploits and backdoors being discovered on a regular basis. As such, an immutable backup should be complemented by other security solutions in order to be truly effective, since it can hardly work as the only backup measure, but it remains a crucial part of the overall recoverability plan since the data in question cannot be modified.

There are several factors that have to be considered when it comes to immutable backups. First of all, while ransomware is a rather widespread method of cybercrime, there are still plenty of other methods that require other measures in place so that the system in question can operate properly. As such, it is always better to try and prevent ransomware from accessing backups in the first place instead of letting it all in knowing that there should be no way for the attacker to steal or modify said data in one way or another.

Additionally, there is an entire category of ransomware that targets backups specifically. There is even ransomware that is difficult to detect and does not activate immediately after appearing in a system, making its detection even harder. A company that wants to get the best results from its immutable backups also has to implement:

• Additional security procedures capable of detecting backdoors and bad actors capable of tampering with immutable backup copies in one way or another (such as deleting clusters that host them)
• Strong credential/access management strategies, such as MFA (Multi-Factor Authentication), RBAC (Role-Based Access Control), or even a requirement for at least two separate people’s confirmation for being able to perform some actions on an administrative level
• Comprehensive cyber resiliency strategy for end users that goes beyond the capabilities of backup and recovery solutions to ensure that some attack angles could be either detected or outright prevented

At the same time, there is an entirely new variation of the ransomware approach that gets more and more widespread, it is called double extortion ransomware. For these attacks, the attacker encrypts the company’s data while also threatening to publish it if his demands are not met. As such, constant data encryption and many other security measures are just as necessary as immutable backup, since even something as strict as air-gapped storage has its own vulnerabilities if used as the only data security measure.

Air gapping and immutable backups

Air gapping is one of several ways to achieve backup immutability – aside from setting the backup file to “read-only” status, there is always an option of physically removing any connection between the backup and the outside world. This is the most basic definition of air gapping. Data that is disconnected from any other device is one of the stronger security methods at this point, with the entire world being comprised of billions of interconnected devices of all shapes and sizes.

Air gapping is considered to be at its most effective when used in a context of a so-called 3-2-1 backup rule. This is a particularly old rule that is still widely used in many backup situations. A 3-2-1 rule implies that a system has at least three different copies of all necessary data, with these three copies being stored using at least two different storage types, and at least one of those copies has to be stored away from the rest, be it on an off-site storage location, in cloud storage, etc.

Of course, air gapping has its own limits, just like the entire concept of immutable backups. This data can still be infected before being backed up, it can still be affected by a removable storage device if that device was infected beforehand, and so on.

Immutable backup solutions

At this point, the overall market for backup solutions is vast and varied, which is why it is not particularly difficult to find plenty of solutions that offer backup immutability as one of its many options. In fact, the overwhelming majority of the most popular backup solutions work as immutable backup solutions, with examples such as:

Unitrends

Unitrends is a proprietary cloud environment capable of integrating with plenty of different backup appliances to create a Disaster Recovery as a Service solution with long-term data retention that can be used to solve many different modern-world data governance problems. Unitrends’ goal is to simplify management and achieve resilience for both software and hardware with features such as automation and many others – ransomware protection, recovery assurance, predictive analytics, 24/7 customer support, and so on.

Veeam Backup & Replication

Veeam Backup & Replication is Veeam’s flagship product, capable of providing availability for a multitude of different workload types. It is a reliable and flexible solution for backup, recovery, and archival operations that are controlled with an easy-to-use management console. Veeam Backup & Replication provides a multitude of features, including instant recovery, continuous data protection, granular file recovery, image-based backups, portability, support for enterprise applications, and more.

Veritas NetBackup

Operating on a backup-as-a-service model, Veritas NetBackup is a data protection solution for large companies and enterprises. It can work with a plethora of different target locations, including cloud systems, physical deployments, and virtual environments, while also offering features such as automated disaster recovery. Some of the more detailed features of Veritas are instant VM recovery, data deduplication, role-based access control, plugin support, the capability to work with different database standards, etc.

Commvault Complete Data Protection

Commvault Complete Data Protection offers a combination of business continuity and data availability for both cloud and on-premise environments by providing a plethora of different features to all of its users. Commvault can offer resilient ransomware protection with encryption and end-to-end data security, centralized access to a variety of backup-related operations, from backups to replication and disaster recovery, as well as the ability to reuse data to facilitate testing and other DevOps tasks with ease. Other capabilities of Commvault include outstanding scalability, a verifiable replica recovery feature, and more.

Bacula Enterprise

Bacula Enterprise is a comprehensive backup and recovery solution for large companies and enterprises that is also one of the few players in this part of the market that does not calculate its price based on the amount of data transferred. Bacula can cover physical, virtual, and cloud environments with the same high level of versatility and reliability, while also being incredibly secure. Bacula Enterprise also has a flexible system of modules that allows the solution to become even more specialized and useful than ever before, offering a truly impressive number of different features, including some of the more uncommon ones, such as bare metal recovery, Multi-Factor Authentication support, Changed Block Tracking, and many others.

Druva Data Resiliency Cloud

Druva Data Resiliency Cloud is a combination of two former Druva projects – Phoenix and inSync. It is a data security solution that offers information governance, data management, and data protection in a single package. Data Resiliency Cloud Platform is delivered as a service, offering backup simplification, better compliance, faster archival, and more efficient device management to protect end-user data while improving data visibility and ensuring regulatory compliance. The solution claims to be able to offer complete protection without any productivity impact by using centralized management, self-help data recovery, and other features.

MSP360

MSP360 is a solution that was formerly known as CloudBerry Lab – it is a managed backup software that targets MSPs that intend to resell the service in question. It can be deployed directly, as well, but this process is a bit more complicated. MSP360 does not have its own storage resource, offering a choice between multiple third-party cloud storage services for any customer to choose from. MSP360 is a rather competent backup solution that prioritizes cloud services and mostly targets small and mid-sized businesses (while also being capable of working with some of the larger companies).

Zerto

Zerto is an entire data protection platform that can perform continuous backup tasks, as well as disaster recovery and other data-related tasks with centralized management and a high level of security. Zerto itself is created with continuous data protection in mind, offering a solution with an always-on nature that allows for development sandboxes, data migrations, on-demand tests, and many others. Zerto’s native automation and orchestration capabilities are aiming to eliminate a lot of manual work in backup planning and realization, improving efficiency and boosting data protection efforts.

Cohesity Helios

One of the main goals of Cohesity Helios is to consolidate silos and eliminate global data fragmentation. It is a data backup and recovery solution that was designed for extreme scalability, and comprehensive data protection with a focus on policies, and support for different data sources. Helios can be used as a service or deployed on-premise, offering a centralized user interface, extensive automation, and converged data protection that eliminates the need for multiple different software appliances that would have to act as media servers, target storages, cloud gateways, and so on.

NAKIVO Backup & Replication

NAKIVO Backup & Replication is a backup recovery software that is versatile, affordable, and effective, capable of protecting several different types of environments – they can be located in the cloud, in a physical location, in a virtual location, or even deployed as a service. NAKIVO provides a plethora of advantages, such as better reliability, faster recovery, and higher backup performance – all of that is possible thanks to NAKIVO’s array of features. As such, NAKIVO can offer protection for a variety of VM types, protection for M365 data, and protection for physical appliances, as well as quick deployment time, low backup size, fast recovery time, and more.

Rubrik

Rubrik is a combination of an enterprise-level backup solution and a cloud data management system that was created by a company with the same name located in Palo Alto. Rubrik offers a vendor-agnostic backup solution that works with a large number of different operating systems, cloud storage providers, hypervisors, applications, databases, and more. Rubrik’s capabilities include operations such as backup, recovery, analytics, archival, compliance, search, and data management – with all of it combined in a single centralized solution.

Conclusion

Since a lot of what can backup solutions offer in terms of immutable backups can be very similar, it becomes a choice between different service providers. At that point, it depends a lot on what a company actually needs from a backup solution. For example, a small or middle-sized company should work fine with solutions like MSP360 and others that target smaller companies.

At the same time, if the company in question is large, then maybe choosing a powerhouse of a backup solution such as Veeam or Bacula Enterprise would be the best in that case – offering a large number of different features and capabilities with centralization, unified interface, simplified management, and so on.

It is a big advantage for every single one of these solutions that all of them have plenty of different backup, recovery, and data protection features to work with. As such, they are much more capable of creating a comprehensive data protection environment that does not rely on a single feature but uses several different approaches that complement one another. This exact approach is how a company can get the most out of immutable backups – by using them in tandem with multiple other features to create a multi-faceted security system that covers as many angles as possible.