Immutable Backups Explained
What an Immutable Backup Is
An immutable backup is a backup that cannot be changed or deleted for a set period after it is written. Once the retention lock is applied, no user, script or attacker holding the stored credentials can overwrite or remove the copy before the period ends, which is why immutability is widely used against ransomware.
The word means unchangeable. In practice the storage system enforces the rule rather than the backup software. Platforms describe this as object lock or write-once-read-many (WORM) storage. The protection applies to the backup files themselves, so it does not depend on the backup software behaving correctly.
Why Ransomware Targets Backups
Ransomware encrypts files and demands payment for the key. Attackers who gain access to a server often look for backups as well, because a victim with intact copies has less reason to pay. If backups can be deleted with the same login used on the live server, the attacker can remove them before or alongside encrypting the site.
Ordinary backups are vulnerable because they are designed to be overwritten or pruned. A retention rule that deletes old copies saves storage, but it also gives an attacker a way to destroy the history. Immutability removes that option for the protected period. For copies that must also be cut off from the network, see air-gapped backups.
How Immutability Protects Restore Points
With immutability, each backup written during the lock period survives even if the production server is compromised. A clean copy from before the infection remains available, giving the owner a restore point they can trust.
Immutability has limits. It stops a backup from being changed or deleted, but it cannot make a backup clean. A locked copy of an already infected site preserves the infection. Restore points must be chosen with care, and the lock period should be long enough to cover intrusions that started earlier than anyone noticed, as discussed in ransomware recovery.
Locked data also stays in storage until the period ends, even when it is no longer needed. The lock period is therefore a balance between protection and storage use.
Frequently asked questions
Can an immutable backup be deleted before the lock expires?
Normally not. Storage platforms that support immutability refuse to delete or change a locked object until its retention period ends. Some platforms offer modes that authorised administrators can override, so check the exact rules of a service before relying on one.
Is an immutable backup enough to protect against ransomware on its own?
No. Immutability keeps a clean copy available, but recovery also depends on having a clean restore point, enough retention to reach back far enough, and a tested restore process. Pairing immutable storage with an off-site copy, as in the 3-2-1 backup rule, gives a more complete defence.