Backups
Ransomware-resistant S3 backups: reduce what the backup credential can destroy
A backup target is not automatically safe from ransomware. If the compromised production system holds a credential that can delete every backup version, the attacker may be able to destroy the recovery path along with the live data.
Separate production and backup credentials
The application server should not carry the provider’s administrative credential. Give the backup process only the bucket actions needed to write and verify its own backup set.
Where the backup software supports it, separate write operations from retention administration so a compromised writer cannot rewrite the policy that protects old copies.
Limit deletion deliberately
Some workflows require pruning old backups, while others can delegate pruning to a provider lifecycle or privileged maintenance process. Decide who needs delete permissions and leave deletion unavailable to identities that do not need it.
Test what happens when the backup credential attempts to remove protected data. A denied deletion is meaningful evidence that the isolation boundary exists.
Use retention features where they fit
Versioning can preserve overwritten generations, and Object Lock can add stronger retention when supported and configured correctly. Neither should be enabled without capacity planning because retained data continues consuming quota.
Retention should protect a time window long enough to detect an incident without making legitimate data governance impossible.
Keep an independent recovery path for critical data
One object-storage account can still be affected by account compromise, provider problems or operator mistakes. High-value systems may justify a second provider or offline copy with separate credentials.
Independence matters more than the number of copies shown in one console. Copies controlled by the same compromised identity share a failure domain.
Restore drills are the final control
Recover representative files and application data on a schedule. Include the credentials, encryption keys and documentation needed to perform the restore when the production environment is unavailable.
A ransomware plan that proves only backup-job success has tested the easy half of the incident.