Immutable storage keeps retained data from being modified or deleted during its protection period. For backups, it is a security control as well as a recovery measure: ransomware should not be able to alter the recovery copies. section 12.11
Avoid the mistake of treating a successful backup as sufficient protection:
- Store backups on immutable storage with an appropriate retention policy, or keep them air-gapped and disconnected from the network. section 12.11 section 12.12
- Encrypt backups as an additional defense. SQL Server supports encrypted backups using a server certificate and algorithms such as AES_256. section 12.11
A safer backup posture
A Marketing database backup can be encrypted with AES_256, then copied to storage that prevents deletion or modification throughout its retention period. Encryption limits exposure if the backup is stolen; immutability protects recovery copies from tampering. section 12.11 section 12.12
