{"id":20095,"date":"2025-09-25T00:39:33","date_gmt":"2025-09-25T00:39:33","guid":{"rendered":"https:\/\/www.sandbox.backupassist.com\/blog\/?p=20095"},"modified":"2025-09-25T01:48:04","modified_gmt":"2025-09-25T01:48:04","slug":"does-cloud-immutability-guarantee-a-restore-point","status":"publish","type":"post","link":"https:\/\/www.sandbox.backupassist.com\/blog\/does-cloud-immutability-guarantee-a-restore-point","title":{"rendered":"Does Cloud Immutability Guarantee a Restore Point?"},"content":{"rendered":"\n

*This article was 100% human written by the author, Linus Chang.<\/em><\/p>\n\n\n\n

TL;DR summary<\/h2>\n\n\n\n

Cloud immutability is absolutely vital for achieving the highest level of cyber-resilience, but surprisingly to many, it’s not a magic wand that will get you there automatically.<\/p>\n\n\n\n

Instead, think of cloud immutability as the fundamental building block – reliable cloud storage that will be ready for you when you need it, even if a hacker has broken in and deleted the data.<\/p>\n\n\n\n

On top of this storage sits a stack of technologies that must work together in unison – using the right backup software that supports immutability, with the correct backup configuration, running on your systems.<\/p>\n\n\n\n

It’s the combination of this stack that will give you a dependable restore point, and the highest level of cyber-resilience.<\/p>\n\n\n\n

Table of Contents<\/h2>\n\n\n\n
  1. What problem does Cloud Immutability solve?<\/li>
  2. The role of backup software<\/li>
  3. The role of the cloud storage provider<\/li>
  4. Who should consider cloud immutability?<\/li>
  5. Are there downsides?<\/li>
  6. Putting it together<\/li><\/ol>\n\n\n\n

    What problem does Cloud Immutability solve?<\/h2>\n\n\n\n

    There’s a very real problem that cloud immutability<\/a> is designed to solve: to stop hackers from holding you to ransom.<\/p>\n\n\n\n

    Let’s try to understand this by drawing out the components of a backup system:<\/p>\n\n\n\n

    \"\"<\/a><\/figure>\n\n\n\n

    <\/p>\n\n\n\n

    The key weakness is that underpinning the entire backup system is the backup storage layer. For a variety of reasons (which I’ll write about in other articles), hackers nearly always try to attack the backup storage layer and irrevocably delete the backup data. Then the hacker can install ransomware on the live I.T. systems, leaving the victim locked out of their own data, with no backup and no option other than to pay the ransom.<\/p>\n\n\n\n

    Cloud immutability solves this problem by implementing a write once, read many (WORM) <\/strong>method of storage. Once data is written to the backup storage, it is automatically locked and protected from harm. If an attacker subsequently deletes the data, it looks like it’s deleted, but actually it’s just hidden from view – past versions of that file are still there and can never be purged manually.<\/p>\n\n\n\n

    Each storage provider implements the fine details in slightly different ways, but what’s common is that the data will be preserved for a minimum time period<\/strong>, known as the retention period<\/a>. And the retention periods can only be modified upwards, preventing the attacker from setting it to 0 days (which would then trigger imminent deletion).<\/p>\n\n\n\n

    In practical terms, if you set the retention period to 180 days, it gives you 180 days to realize you suffered some data loss. That’s ample time and opportunity to do a restore.<\/p>\n\n\n\n

    The role of backup software<\/h2>\n\n\n\n

    Immutable cloud storage mitigates against the attack on underlying backup data at the storage level. However, you should think of it like it were a bank vault – while it’s a secure container, it’s up to you to put your jewels inside it.<\/p>\n\n\n\n

    So, in order to get a dependable restore point, you need to ensure you’re putting in the right data into the cloud vault. That’s where backup software comes in. Business-grade products like BackupAssist will:<\/p>\n\n\n\n

    1. Take point-in-time snapshots of your systems and applications (GB or TB in size).<\/li>
    2. Break down those snapshots into individual bite-sized chunks of data suitable for cloud storage (generally MB in size).<\/li>
    3. Apply deduplication, compression and encryption to those chunks.<\/li>
    4. Store those chunks on immutable cloud storage, setting retention dates based on the backup configuration and policies.<\/li>
    5. Maintain catalogs of the data to provide search and restore functions, and storing those catalogs on immutable cloud storage.<\/li><\/ol>\n\n\n\n

      And the entire process runs in reverse when performing a restore.<\/p>\n\n\n\n

      Provided the backup software does not malfunction (for example, backups could be repeatedly interrupted due to unstable internet connection), and it was configured properly by suitably knowledgeable I.T. staff, then the combination of immutable cloud storage and your backup software will give you dependable restore points.<\/p>\n\n\n\n

      A simple example<\/h3>\n\n\n\n

      Let’s say a dental clinic backs up its data to an Amazon S3 bucket using BackupAssist Classic, and cloud immutable storage. Let’s also assume that at least one full backup has been completed and the backup software is configured to keep backups for 180 days.<\/p>\n\n\n\n

      Now let’s also say:<\/p>\n\n\n\n

      1. A hacker has managed to compromise the network of the dental clinic.<\/li>
      2. The hacker also discovered the credentials to the cloud storage account.<\/li>
      3. The hacker deleted all data in the S3 bucket used for backup storage.<\/li>
      4. The hacker changed the configuration of BackupAssist to delete the backup job.<\/li>
      5. No other backup jobs were running (which is not best practice – it means backup eggs were in the same basket).<\/li><\/ol>\n\n\n\n

        Without cloud immutable storage, the dental clinic would be vulnerable and would likely have to pay a ransom – with Step 5 meaning all eggs were in one basket, and Step 3 meaning that one basket was destroyed.<\/p>\n\n\n\n

        With cloud immutable storage, the dental clinic has a dependable restore point. You can simply install BackupAssist on a new computer, point it to your S3 bucket, and it will automatically detect historic backups and past versions, even if the bucket looks like it’s empty.<\/p>\n\n\n\n

        The role of the cloud storage provider<\/h2>\n\n\n\n

        When relying on immutable cloud storage, you’re relying on the cloud provider’s infrastructure as well. Such factors include:<\/p>\n\n\n\n

        1. The software implementation of immutable storage<\/li>
        2. The hardware – RAID arrays, power, networking<\/li>
        3. Any backups or replication that the cloud provider does behind the scenes<\/li>
        4. Service availability – which really matters because the service must be up at the time of backup and restore.<\/li><\/ol>\n\n\n\n

          All these factors are wrapped up into two key figures known as durability <\/strong>and availability<\/strong>. Taking Amazon S3 as an example, and assuming you’ve got 1TB of data, split into 1MB chunks:<\/p>\n\n\n\n