Securing Client Data Against Ransomware

Why this matters

Without a robust recovery strategy that includes immutable storage, a single successful ransomware attack can lead to the permanent loss of all business data, causing devastating financial and reputational damage. Companies that rely solely on standard backups without hardware-level protection often find that attackers have encrypted both the live data and the backup copies, leaving them with no path to recovery.

The core idea

At the heart of modern data protection is the concept of immutability. An immutable snapshot is a point-in-time copy of your file system that is locked by the storage hardware or software so that it cannot be altered, deleted, or encrypted for a specific retention period, even by an administrator with full credentials. Ransomware is malicious software designed to block access to a computer system, usually by encrypting files, and demanding payment for the decryption key. Defense-in-depth is an information security strategy that integrates multiple layers of defensive mechanisms to protect a network.

While encrypting local workstation drives protects against physical theft of a hard drive, it offers zero protection against network-based ransomware because the operating system is already decrypted when the user is logged in, allowing the malware to freely access and lock those files.

How it works in practice

In a professional environment, you must deploy solutions like Veeam Availability Suite, Datto SIRIS, or Dell PowerProtect, which offer native immutability features. First, you define a retention policy that keeps daily snapshots for at least 30 to 90 days. Next, you enable the immutability flag at the storage bucket or volume level. This creates a logical barrier that ignores any commands to delete files or rewrite data until the retention timer expires. For corporate networks, we recommend the 3-2-1-1 rule: keep three copies of data, on two different media types, one off-site, and one immutable or offline.

Products like Wasabi hot cloud storage with object locking or immutable S3 buckets in AWS are standard tools for this. When configuring these arrays, the immutable lock must be configured during the initial setup to ensure that even if an attacker gains control of the domain controller, they cannot issue a command to wipe the backups.

Worked example

Imagine you are speaking with a logistics manager at a medium-sized shipping firm. The manager asks if enabling BitLocker on all employee laptops is sufficient to stop ransomware. If you simply agree, you have failed to address the primary threat vector. The wrong approach is to focus on disk encryption, which only secures data at rest if the hardware is physically stolen. Instead, you should explain: 'While BitLocker is excellent for device security, it doesn't stop ransomware once a user opens an infected email. If a user logs in, the ransomware accesses the network files as that user.

If we don't have immutable snapshots, the ransomware will simply encrypt your backup files as well. Here is how we should fix this: we will implement an immutable storage tier on your backup NAS. Even if the network is compromised, the ransomware cannot change these backups. We can revert to the snapshot from five minutes before the attack and have the business back online in an hour.'

Where people go wrong

First, many professionals mistakenly believe that local disk encryption prevents ransomware. Encryption on a workstation protects against a lost laptop, not an active malware process. Second, people often fail to test their restoration process. An immutable backup is useless if your team does not have a practiced, documented protocol to spin up that data in an emergency. Third, administrators often leave the 'delete' permissions enabled on backup targets. If the ransomware gains access to the administrator account, it can delete non-immutable backups.

Always ensure the 'root' or 'admin' account cannot bypass the immutability lock settings once they are set.

Key takeaways

• Disk encryption protects against physical theft but does not stop ransomware from encrypting active files.
• Always prioritize immutability: hardware-enforced snapshots are the only way to ensure your backups remain untouched by an active attack.
• Implement the 3-2-1-1 rule to ensure geographic diversity and air-gapped or immutable recovery points.
• Educate clients that the backup target must be architecturally isolated from the primary domain admin credentials where possible.
• Treat the backup storage array as the most critical piece of infrastructure, secondary only to the primary firewall.