Use an immutable backup to protect data integrity after a ransomware attack
Traditional backup is no longer enough against ransomware attacks
A modern ransomware attack doesn't just encrypt production data: it actively seeks out backups, encrypts or deletes them before proceeding. If the backup is accessible from the same compromised environment, even with administrative credentials, it doesn't offer real protection. Immutability solves this problem at its root: immutable data cannot be modified or deleted for the configured retention period, regardless of who attempts to do so and with what credentials.
The 3-2-1-1-0 Rule
The 3-2-1-1-0 rule is the data protection framework recommended by Veeam and adopted as an industry standard. For an MSP or IT manager, it's the minimum foundation to start from.
How is immutability achieved with CloudFire?
CloudFire supports backup immutability through two distinct paths, each employing technologies and
Veeam and Object Lock on Scalable Object Storage
With Veeam Backup & Replication, immutability is achieved by configuring CloudFire's Scalable Object Storage as an S3 repository with Object Lock enabled in WORM mode. The backup is written to the bucket and locked for the defined retention period: no process, no credentials, and no malware can modify or delete it before its expiration.
Acronis Cyber Protect Cloud with Native Immutability
With Acronis Cyber Protect Cloud, immutability is built directly into the service: it doesn't require separate S3 repository configuration or specific additional licenses. Acronis manages immutable storage through its own protection layer, which prevents modifications or deletions of backups for the set retention period.
Why choose Immutability?
Ransomware protection
Immutable backups cannot be encrypted or deleted, even if ransomware reaches the backup environment or compromises administrative credentials.
Regulatory compliance
Regulations in many industries require data to be preserved intact for defined periods. Immutability meets this requirement by design, not by declaration.
Human error prevention
Immutable data cannot be accidentally deleted by an operator, a faulty script, or a misconfigured retention policy.
Verifiable integrity
With Veeam SureBackup and Acronis' automated verifications, you can test the recovery of immutable backups and document that your data is intact and recoverable.
Resources
Cloud privacy isn't enough without access control. Discover how digital sovereignty ensures you maintain real control over your data.
Acronis Cyber Protect Cloud
Integra funzionalità avanzate di Cyber Security ad una soluzione di Backup as a Service funzionale e performante.
Veeam Cloud Platform
Completa e gestisci la tua soluzione Veeam Cloud Backup con infrastruttura, storage immutabile e licenze in pochi clic.
FAQ
What does it mean for a backup to be immutable?
An immutable backup is written in WORM (Write Once Read Many) mode: once created, it cannot be modified, encrypted, or deleted for the configured retention period. This protection holds even if administrative credentials are compromised.
What is the difference between immutability with Veeam and with Acronis on CloudFire?
With Veeam, immutability is achieved by configuring Object Lock on the CloudFire Scalable Object Storage S3 bucket: it is a technical implementation that requires Veeam Enterprise licenses or higher and a specific bucket configuration. With Acronis Cyber Protect Cloud, immutability is built into the service and requires no additional repository configuration.
Do Veeam Community Edition or Essentials support Object Lock?
No. Object Lock through Veeam requires Enterprise licenses or higher for the Scale-Out Repository. With lower licenses, you can use Scalable Object Storage as a standard S3 repository, but without WORM immutability.
Are immutable backups accessible for restores?
Yes. Immutability prevents modification and deletion, not reading. Backups remain fully accessible for restore throughout the retention period.
Where are backups physically stored with CloudFire?
It depends on the solution you choose. With Veeam Cloud Platform, backups are stored in the MI1 data center in Milan (Data4), Italy. With Acronis Cyber Protect Cloud, data is stored in Acronis's data center in Frankfurt, Germany. If you need your data located exclusively in Italy, Veeam Cloud Platform with a CloudFire repository is the right choice.
How do you verify that an immutable backup can actually be restored?
With Veeam, you use SureBackup, which runs automated VM boot tests from backup and verifies data integrity. Acronis Cyber Protect Cloud includes built-in automated verification. Both produce documentable reports.
Does immutability also protect against retention misconfigurations?
Partially. WORM immutability protects data from being deleted before it expires. It does not protect against a retention period that is set too short: if you set 7 days and the ransomware is discovered after 10, older backups may not be available. Retention planning is part of the strategy, not a detail.