What is an immutable backup?
An immutable backup is a backup that cannot be modified, encrypted or deleted by anyone until a set retention period expires. Once it is written, the storage system itself refuses changes, whichever account makes the request, including an administrator's. The older name for the idea is WORM, write once, read many, which began with optical discs and special tape cartridges and is now mostly enforced in software by backup appliances and cloud object storage.
Why immutability matters against ransomware
Ransomware operators know backups are the victim's way out, so a typical attack goes after them first: gain administrator rights, find the backup console, delete backup jobs and restore points, remove Windows Volume Shadow Copies with a command such as vssadmin delete shadows /all /quiet, and only then encrypt production. Ordinary backups on a domain-joined appliance fall to the same stolen credentials. Replication does not help either, because it copies the deletions and encrypted files to the second site. An immutable copy breaks that sequence: the attacker can hold every admin account in the company and still cannot remove the restore points.
How immutability is implemented
- Object lock in cloud storage: Amazon S3 Object Lock sets a retain-until date on each object. In governance mode, accounts with a special bypass permission can still delete objects or shorten retention. In compliance mode, no one can, including the account's root user, until the date passes. A legal hold keeps an object indefinitely until the hold is removed. Azure Blob Storage and other providers offer similar immutability policies.
- Hardened backup repositories: on-premises appliances and locked-down Linux repositories that enforce retention on local disk and refuse deletion requests, even from the backup server's own credentials.
- WORM tape and offline media: WORM cartridges cannot be overwritten, and tapes stored in a vault are also offline, out of an attacker's reach entirely.
For ransomware protection, compliance mode is the stronger choice, because a compromised administrator may hold the bypass permission that governance mode allows.
Example: a backup design with an immutable tier
A company follows the 3-2-1 rule (three copies, two types of storage, one offsite) and the 3-2-1-1-0 extension some vendors promote, which adds one offline or immutable copy and zero errors in verified restores. Nightly backups go to a local repository for fast restores. A second copy goes to cloud object storage with compliance-mode object lock and 35-day retention, in a separate cloud account with its own credentials and MFA. When attackers later wipe the local repository, the team restores from the locked copy, which still holds every nightly restore point from the past five weeks.
Limits and cautions
- Immutable does not mean clean. If malware or an attacker's backdoor was already in the data when it was backed up, the immutable copy preserves it. Restore into an isolated network and scan before reconnecting.
- Retention must outlast attacker dwell time. Attackers often sit in a network for weeks before encrypting. If every restore point is newer than the intrusion, all of them contain it.
- Mistakes are expensive. Compliance-mode retention cannot be shortened, so an overly long setting means paying to store the data until it expires.
- The management plane still matters. Protect the backup console and cloud account with separate admin accounts and MFA, and alert on attempts to change retention settings for new backups.
Immutable vs. offsite and air-gapped backups
An offsite backup is stored far enough away that one fire or flood cannot reach both copies. An offline or air-gapped backup is disconnected from every network. An immutable backup may be online and reachable, but it cannot be altered. They protect against different things, which is why strong designs combine them: offsite survives the loss of the building, offline survives a network-wide compromise, and immutable survives stolen admin credentials while staying quick to restore.
Immutable backup on the CompTIA Security+ exam
Backups, including immutability, fall under SY0-801 objective 3.4, which covers why systems must be designed to survive failures and recover from them. Scenario wording such as "attackers with domain admin rights deleted the backups", "restore points must survive a compromised administrator" or "backups cannot be altered for 30 days" points to an immutable backup, often described as object lock or WORM. Distractors include replicating backups to a second data center, which copies the deletion; encrypting backups with AES-256, which protects confidentiality, not the backup's existence; more frequent snapshots on the same storage array; and RAID. If the question asks how to know a backup will work, the answer is restoration testing, not immutability.