Backup Security Hardening Review
The backup system holds a copy of everything. We check that it is protected at least as well as the systems it backs up.
If the backup server trusts the domain, it falls with the domain
Backup servers joined to production and managed with domain admin accounts are a common way ransomware reaches backups.
Deleted jobs and shortened retention should raise an alarm
We check that the actions attackers take against backups trigger alerts someone sees.
Why the backup system is a target
Attackers know that working backups remove their leverage, so they look for the backup console, the backup service accounts and the storage behind them. Hardening the backup platform is the step that keeps those backups available when you need them.
The CISA #StopRansomware Guide recommends keeping offline, encrypted backups and testing them regularly. The audit checks the controls around the backup platform itself.
For Windows domains, this page works together with the Active Directory backup and recovery audit.
Backup security controls we evaluate
| Control | Default severity |
|---|---|
| MFA on the backup console and cloud backup portal | High |
| Separate admin accounts for backup administration | High |
| Backup server not joined to the production domain | High |
| Least-privilege backup service accounts | Medium |
| Encryption keys and passwords stored outside the backup system | High |
| Alerts on failed or deleted jobs and retention changes | Medium |
| Backup server patched and hardened | High |
| Console reachable only from admin networks | Medium |
| Backup logs sent to a central log or SIEM | Medium |
| Access reviews of backup administrators | Low |
What we look for and why
Identity separation
Backup admins should not use the same accounts, password vault or MFA method that an attacker would steal first.
Key custody
If encryption keys are lost with the backup server, encrypted backups cannot be restored. We check where keys are kept and who can reach them.
Detection
Mass deletion, disabled jobs and retention changes are attacker signals. They should page someone.
A finding from the sample report
- Area
- Backup security
- Finding
- Backup console uses domain sign-in without MFA
- Severity
- High
- Evidence
- The backup console accepts domain credentials and has no MFA. Seven accounts can sign in, including two shared admin accounts. No alert is configured for deleted backup jobs.
- Fix
- Enable MFA, use dedicated backup admin accounts outside the production domain, remove shared accounts and add alerts for job deletion and retention changes.
Every finding in the real report has this shape. See the full sample report
A read-only audit in five steps
Scoping call
We confirm your systems, backup products, cloud services, compliance needs and who on your side should take part.
Documents and interviews
We request your backup reports, DR plan, restore test records and BIA, and interview your IT lead and the business owners of critical systems.
Read-only review
We review backup consoles and cloud vaults through a read-only role or a screen-share. Nothing is installed or changed.
Analysis
96 checks in 8 domains, each rated Pass, Partial, Fail or Not applicable, with the evidence behind it.
Report and roadmap
Executive summary, technical report, risk register, remediation roadmap and Excel workbook, walked through on a call.
Where to go next
Immutable and air-gapped backups
The copy that survives a stolen admin account.
Active Directory backup and recovery audit
Domain-specific backup checks.
Want a quick self-check first? Backup and disaster recovery self-assessment · Ransomware recovery cost estimator
Page 5 of 16: Backup security hardening
- 1. Backup & Disaster Recovery Audit (hub)
- 2. Backup strategy: 3-2-1 and 3-2-1-1-0
- 3. Immutable & air-gapped backups
- 4. RPO, RTO, uptime & availability
- 5. Backup security hardening (this page)
- 6. Cloud backup for business
- 7. Microsoft 365 backup
- 8. Server, VM & database backup
- 9. Restore testing & evidence
- 10. Disaster recovery plan & DRaaS
- 11. Backup vendor selection guide
- 12. Backup compliance requirements
- 13. Sample report
- 14. Backup & DR checklist
- 15. Pricing
- 16. How to audit backups
Guided by Ali Hassani, CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure, and dozens of Microsoft and Cisco certifications, including MCSE, MCITP, MCSA Security, CCNP and CCNA. Every backup and disaster recovery audit is read-only, vendor-neutral and written so an owner and an administrator can both act on it.
Questions IT leaders ask
Should the backup server be joined to the domain?
In most environments it should not be joined to the production domain, or it should use a separate management domain, so that a domain compromise does not hand over the backups. The right design depends on the product and is set out in the roadmap.
Do you change anything in our backup system?
No. The audit is read-only. We review settings, job history and documents through a read-only role or a screen-share with your administrator. We never change, delete or run backup jobs.
Do you sell backup products?
No. OC Security Audit does not resell any backup product and earns no referral fees. If you want help installing or reconfiguring the product you choose, IT Perfection can do that work separately.
Implementation partner
OC Security Audit stays independent and read-only, and does not resell any backup product. If you want hands-on help installing or reconfiguring the product you choose, adding immutable storage or running restore tests, IT Perfection can do that work and support ongoing operations.
Protect the system that protects everything else
Schedule a consultation. We scope the backup and disaster recovery audit in 30 minutes and quote one fixed price: $3,500, any organization size.
Read-only audit. No changes to your systems. Irvine, Orange County and Southern California on-site; remote nationwide.