Threat-model the backup

Backups are valuable targets. Modern ransomware crews go for them first, because a victim with working backups doesn’t pay. So the backup system itself needs a threat model, the same way the live system does.

The core question: who can delete or read my backups, and from where?

Start with the worst realistic case. An attacker with the same credentials may delete both live data and every recovery point. If your server holds a credential that can write and delete backups, then anyone who owns the server owns your backups too.

Build a threat table

Create a threat table, one row per scenario:

threat: compromised server
path: backup credentials readable by root
control: append-only or separate deletion credentials
recovery test: restore from protected snapshot

The path column forces honesty: exactly how would this threat reach the backups? The control column names the defense. For a compromised server, the standard controls are append-only storage (the server can add snapshots but never remove them) or split credentials, where the delete permission lives on a separate administrator account the server never sees.

Now add the quieter threats. Each gets its own row:

threat: accidental deletion       control: version history, retention
threat: silent corruption          control: integrity checks, checksums
threat: lost backup password       control: escrowed key, second keyholder
threat: expired cloud account      control: billing alerts, second provider
threat: unavailable restore tool   control: documented versions, offline copy
threat: legal retention needs      control: written policy, immutable storage

The unglamorous rows matter most. Far more backups die from an expired credit card or a forgotten password than from attackers.

No single control covers everything

Encryption protects confidentiality but not deletion — an attacker doesn’t need to read your backups to destroy them. Immutability protects history but not a lost decryption key: your snapshots can sit safe and unreadable forever. Every control in the table answers one threat and ignores the others. That’s why you need the whole table, not one favorite defense.