Immutable and Air-Gapped Backups
Make at least one backup copy that an attacker with stolen admin credentials cannot change, encrypt or delete. We verify it is really immutable.
Attackers affected the backups in 76% of attacks
Veeam’s 2024 report found backup repositories targeted in 96% of attacks. Immutability is the control designed for this.
A setting screen is not proof of immutability
We check who can shorten retention, where the credentials live and whether a restore from the immutable copy has worked.
What makes a backup immutable
An immutable backup is written once and cannot be changed or deleted until its retention period ends, even by an administrator. An air-gapped backup is separated from the production network, either physically (offline media) or logically (a separate account, network or tenant with no standing access).
Common ways to get immutability include object storage with object lock (for example Amazon S3 Object Lock and Azure immutable Blob storage), locked cloud backup vaults (Azure Backup immutable vaults, AWS Backup Vault Lock), hardened Linux repositories and vendor appliances with retention lock.
The audit checks whether the immutability you paid for actually holds against a realistic attacker.
What we check for immutability and isolation
| Check | Why it matters |
|---|---|
| Immutability is enabled on at least one copy | Without it, an attacker with admin rights can delete every backup |
| Retention lock cannot be shortened by one admin | Some modes allow privileged users to remove the lock |
| Immutability period exceeds likely dwell time | Short locks expire before the attack is noticed |
| Backup storage lives in a separate account or tenant | Stolen production credentials should not reach it |
| Off-site credentials are not stored on production servers | Saved keys hand the attacker the off-site copy |
| A restore from the immutable copy was tested | Proves the copy is complete and usable |
What we look for and why
Governance vs compliance modes
Object lock usually has a mode that privileged users can override and a mode nobody can. We record which one you use and who can change it.
Logical air gap
A cloud copy in the same tenant, with the same admin accounts, is not air-gapped. Separation of identity matters as much as separation of network.
Snapshots are not enough
Storage snapshots on the same array help with mistakes but share the array’s admin access and failure modes.
A finding from the sample report
- Area
- Immutability and isolation
- Finding
- Cloud backup bucket uses a retention mode that admins can override
- Severity
- High
- Evidence
- Object lock is enabled on the off-site bucket, but in a mode that allows users with a bypass permission to delete objects. Two IT accounts and one integration key hold that permission. The keys are saved on the backup server.
- Fix
- Move to a mode that cannot be bypassed for the required retention period, remove the bypass permission from daily accounts, store keys outside production, and test a restore from the locked copy.
Every finding in the real report has this shape. See the full sample report
A read-only audit in five steps
Scoping call
We confirm your systems, backup products, cloud services, compliance needs and who on your side should take part.
Documents and interviews
We request your backup reports, DR plan, restore test records and BIA, and interview your IT lead and the business owners of critical systems.
Read-only review
We review backup consoles and cloud vaults through a read-only role or a screen-share. Nothing is installed or changed.
Analysis
96 checks in 8 domains, each rated Pass, Partial, Fail or Not applicable, with the evidence behind it.
Report and roadmap
Executive summary, technical report, risk register, remediation roadmap and Excel workbook, walked through on a call.
Where to go next
Want a quick self-check first? Backup and disaster recovery self-assessment · Ransomware recovery cost estimator
Page 3 of 16: Immutable & air-gapped backups
- 1. Backup & Disaster Recovery Audit (hub)
- 2. Backup strategy: 3-2-1 and 3-2-1-1-0
- 3. Immutable & air-gapped backups (this page)
- 4. RPO, RTO, uptime & availability
- 5. Backup security hardening
- 6. Cloud backup for business
- 7. Microsoft 365 backup
- 8. Server, VM & database backup
- 9. Restore testing & evidence
- 10. Disaster recovery plan & DRaaS
- 11. Backup vendor selection guide
- 12. Backup compliance requirements
- 13. Sample report
- 14. Backup & DR checklist
- 15. Pricing
- 16. How to audit backups
Guided by Ali Hassani, CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure, and dozens of Microsoft and Cisco certifications, including MCSE, MCITP, MCSA Security, CCNP and CCNA. Every backup and disaster recovery audit is read-only, vendor-neutral and written so an owner and an administrator can both act on it.
Questions IT leaders ask
What is the difference between immutable and air-gapped?
Immutable means the data cannot be changed or deleted until retention ends. Air-gapped means the copy is separated from the production network or identities. The strongest designs use both.
How long should the immutability period be?
Long enough to cover the time an attacker could stay undetected plus your detection and response time. The right number depends on your environment and is set in the remediation roadmap.
Do you change anything in our backup system?
No. The audit is read-only. We review settings, job history and documents through a read-only role or a screen-share with your administrator. We never change, delete or run backup jobs.
Do you sell backup products?
No. OC Security Audit does not resell any backup product and earns no referral fees. If you want help installing or reconfiguring the product you choose, IT Perfection can do that work separately.
Implementation partner
OC Security Audit stays independent and read-only, and does not resell any backup product. If you want hands-on help installing or reconfiguring the product you choose, adding immutable storage or running restore tests, IT Perfection can do that work and support ongoing operations.
Make sure your last good copy is out of reach
Schedule a consultation. We scope the backup and disaster recovery audit in 30 minutes and quote one fixed price: $3,500, any organization size.
Read-only audit. No changes to your systems. Irvine, Orange County and Southern California on-site; remote nationwide.