Security and governance
How do I know if backups are protected from ransomware?
Check whether attackers or compromised administrator accounts can delete or encrypt the backups. Use separate credentials, protected or immutable copies, limited write access, and offline or isolated recovery options where appropriate. Test restore from a protected copy.
What to check
- Are backup credentials separate from normal admin accounts?
- Can backups be altered or deleted easily?
- Has a restore from the protected copy been tested?