InfrastructureTRENDING ARCHITECTURE

Ransomware-Resilient Backup and DR: 3-2-1-1-0, Immutability, and Recovery Drills

A modern backup and disaster recovery guide: designing for ransomware, immutable storage, MFA for consoles, and regular recovery testing with measurable RPO/RTO targets.

11 May 2025

14 min read

835 verified reads

Back to journalConsult engineering

Elena Petrova

Infrastructure Architect

Backups that "succeed" are not the same as backups you can restore under pressure. Modern ransomware targets backup consoles, deletes snapshots, and encrypts reachable shares. A resilient design assumes attackers may obtain domain-level access and still plans for recovery: immutable copies, isolated credentials, and routine restore drills.

1) Define RPO/RTO by system (not by opinion)

Start with business targets. Typical SME targets: identity/email RTO 4 hours, file shares RTO 8-24 hours, ERP RTO 24 hours, dev systems RTO 48-72 hours. Without targets, teams either overpay for gold backups everywhere or under-protect critical workloads.

2) 3-2-1-1-0 explained (and what teams miss)

3 copies of data (production + 2 backups).
2 different media (disk + object storage/tape).
1 copy offsite (different fault domain/account).
1 copy offline or immutable (cannot be altered for retention period).
0 errors (verified restores, not just backup completed).

3) Harden the backup platform like Tier 0

Separate backup admin accounts from domain admins; require MFA everywhere.
Limit console access to a management network or jump host.
Enable immutability on repositories; protect repository credentials.
Forward backup audit logs to SIEM (delete job, change repository, disable immutability).

4) Immutable object storage example (AWS S3 Object Lock)

bash

S3 Object Lock (illustrative)

aws s3api create-bucket --bucket company-backup-immutable --region us-east-1
aws s3api put-object-lock-configuration --bucket company-backup-immutable --object-lock-configuration "ObjectLockEnabled=Enabled,Rule={DefaultRetention={Mode=COMPLIANCE,Days=30}}"

5) Recovery drills: the KPI that matters

Schedule drills quarterly. Perform real restores: file-level restore, VM restore, and one application-consistent database restore. Track time-to-restore and failure reasons. The goal is to make restoration boring and repeatable.

Measured outcome from a 2-site org (~60 VMs + M365): after immutable offsite copies and quarterly drills, full file server restore time went from an estimated 2 days (never tested) to a measured 6 hours including permission validation.