The reliable way to keep ransomware from destroying your backups is defense in depth: maintain several copies, encrypt them, isolate at least one copy from production credentials and network paths, enforce a write-once retention policy, and routinely prove that you can restore. Immutability prevents a protected backup version from being overwritten or deleted during its retention period; it does not make an incomplete, infected, or untested backup useful.
A practical design is the 3-2-1-1 pattern: three total copies, on two media types, with one copy off-site and one copy immutable and isolated. Add a disconnected encrypted drive or other offline medium for critical data, separate administration and encryption keys from production, monitor changes, and document the recovery sequence.
As an Amazon Associate I earn from qualifying purchases.
What an immutable backup protects
An immutable backup is stored so that data cannot be changed or removed for a defined period, even by an administrator whose account has broad privileges. The usual mechanism is WORM storage: write once, read many. A backup object can be written and read, but overwrite and delete operations are blocked until retention expires or a legally defined hold is released.
Free tools Windows power users keep installed
One-click scans. No signup required.
This matters because ransomware commonly attacks the backup system after compromising endpoints or an identity provider. If the attacker can use a production credential to delete snapshots, shorten retention, rewrite backup objects, or encrypt the repository, a backup that exists on paper may be unavailable during recovery. Immutability changes the attacker’s problem: a correctly locked version remains available while the incident is contained.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Immutability is not the same as encryption, an air gap, or a restore guarantee:
- Encryption protects confidentiality and helps prevent an intruder who steals the media from reading it. It does not stop a permitted account from deleting or rewriting accessible backup data.
- Isolation removes network and credential paths that ransomware can use. An offline drive is isolated while disconnected; a cloud vault can be isolated logically through separate accounts, subscriptions, and permissions.
- Immutability protects retained versions against alteration and deletion. It does not detect malware that was already present when the backup was created.
- Restore testing demonstrates that the retained data, keys, applications, and procedures actually work together.
CISA’s #StopRansomware Guide states: “Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.” Treat that as a minimum control rather than a complete architecture.
Choose the backup architecture before configuring storage
Use 3-2-1-1 as a design rule
The 3-2-1-1 pattern described by Microsoft means three copies of the data, two different media types, one copy off-site, and one copy immutable and isolated. The pattern is a configuration rule, not a measured success rate or a guarantee against every failure.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems| Copy | Typical location | Purpose | Ransomware control |
|---|---|---|---|
| Production | Live servers, endpoints, or primary cloud workloads | Normal operations | Not counted as a safe backup; it can be encrypted first |
| Fast recovery copy | Local backup appliance or separate storage system | Quick recovery from accidental deletion, hardware failure, or a small incident | Must use separate credentials and monitoring; do not assume local means protected |
| Off-site copy | Different facility or cloud region | Survival of fire, flood, site loss, or a broad network compromise | Keep it outside the production account or subscription |
| Immutable and isolated copy | WORM-locked cloud vault or disconnected encrypted media | Recovery when attackers control production administration | Retention and isolation block overwrite and deletion |
For highly critical systems, use both an immutable cloud copy and a periodically refreshed offline copy. They fail differently: a cloud lock can preserve many restore points and support remote operations, while disconnected media removes network attack paths but requires disciplined handling and a tested process for reconnecting it.
Inventory what must be rebuilt
Start with a service and data inventory, not a storage purchase. For each workload, record the owner, dependencies, recovery priority, target recovery point objective (RPO), target recovery time objective (RTO), and the people authorized to approve restoration.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
- Business databases, file shares, virtual machines, source repositories, and user data.
- Identity systems, directory services, DNS, network configuration, certificates, and secrets needed to authenticate during recovery.
- Application configuration, licensing information, installers, golden images, and infrastructure-as-code or equivalent build documentation.
- Backup catalogs and encryption-key metadata required to locate and decrypt a restore point.
Classify data by how much loss the business can tolerate. A database with a four-hour RPO needs more frequent capture than an archive that can lose a week. Put the highest-priority systems first in the restore order, and make sure their dependencies appear earlier in that order.
Implementation sequence
1. Create multiple copies on different failure domains
Configure at least two backup destinations in addition to production, using different media or storage services. Do not satisfy the “two media” requirement with two folders in the same account, cluster, or physical array. A repository that shares the same administrator, network route, and failure domain as production is a second location, not an independent defense.
Set schedules from the RPO for each workload. Keep enough historical versions to cover the time between compromise and detection; a short retention window can expire every clean restore point before the incident is discovered. Where regulations or contracts require longer preservation, map those requirements to the retention policy and legal-hold process.
2. Encrypt data and manage keys separately
Encrypt backup traffic in transit and backup data at rest. Store encryption keys in a service or system administered separately from the backup repository, and limit key use to the smallest set of backup and recovery roles. Keep an emergency recovery procedure for key access when the normal identity system is unavailable.
Key separation is essential but introduces a recovery dependency. A locked backup that cannot be decrypted is operationally equivalent to no backup. Test key retrieval and decryption as part of every scheduled restore exercise, and protect key backups with the same isolation and retention discipline as the data.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
3. Build an offline copy
An offline copy is physically or logically disconnected when no backup or restore operation is in progress. For a removable drive workflow:
Recommended Free Tools
- Use an encrypted removable drive or another storage device with sufficient capacity for the selected backup sets and retention window.
- Connect it only to a controlled backup host, authenticate with a dedicated account, and write the backup.
- Verify the job, catalog, checksums where available, and a sample restore before disconnecting.
- Safely eject the device, disconnect every data and power connection, and store it in a secure, access-controlled location separate from the production site.
- Label the media with an asset identifier and retention or rotation date without exposing sensitive data on the label.
- Reconnect only for a scheduled backup rotation or a controlled restore, then repeat verification and disconnection.
Keep more than one offline device in rotation if the RPO and retention period require continuous coverage. A single drive that is connected for every job is not an air-gapped copy; it is an online repository with removable hardware.
4. Apply WORM retention correctly
Retention is where many “immutable” designs fail. The policy must be enforced by the storage service, not merely by a backup application setting that a compromised administrator can change.
For Amazon S3 Object Lock, enable Versioning and Object Lock before placing objects under retention. Choose the retention model and duration deliberately:
- Fixed retention keeps an object protected until a specified date.
- Variable retention assigns retention periods according to the object or backup policy.
- Legal hold keeps an object indefinitely until an authorized hold is explicitly released.
AWS documentation describes Object Lock as preventing deletion or overwrite during fixed, variable, or indefinite periods. Keep the account and permissions that can change Object Lock settings outside the production administration path, and verify the setting by attempting a controlled delete with a test object.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
For AWS Backup, Vault Lock can enforce a minimum and maximum retention range so that a privileged user cannot shorten retention or delete protected recovery points. AWS also documents a logically air-gapped vault option for critical systems. Treat the vault account, key administration, and break-glass procedures as separate from the workload account.
For Azure Backup, enable immutability and review the operational consequences before moving a vault to the irreversible Locked state. A lock can be the right choice for a high-value recovery vault, but it must match legal retention, storage growth, and deletion requirements because the decision cannot be casually undone.
5. Separate administration from production
Create distinct accounts, subscriptions, or projects for backup storage. Use least-privilege roles, phishing-resistant MFA where supported, and a small, named group for retention-policy administration. Production administrators should be able to request or initiate recovery without automatically having permission to erase the protected copy.
- Use separate credentials for backup jobs and human administration.
- Deny production identities the ability to disable immutability, shorten retention, delete vaults, or destroy encryption keys.
- Require a second approval for retention changes, legal-hold release, key deletion, and break-glass access.
- Store emergency credentials offline or in a protected vault that is not dependent on the compromised production directory.
- Review role membership and access logs on a fixed schedule, not only after an incident.
6. Monitor the controls attackers target
Send backup and storage audit events to a monitoring system that ransomware cannot alter through the ordinary production account. Alert on failed or suddenly shortened backup jobs, disabled protection, retention-policy changes, legal-hold release, unusual reads, mass deletes, new administrators, key-use anomalies, and encryption activity on hosts that normally do not encrypt large volumes.
Alert quality matters. A notification that only says “backup failed” is not enough; include the affected workload, last successful restore point, retention expiry, and the owner responsible for triage. Keep an independent record of alerts so an attacker cannot erase the evidence by compromising the backup console.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
7. Test restoration, not just backup completion
A green backup-job status proves that a job ran. It does not prove that the catalog is complete, the keys are available, the application can start, or the restored data is clean.
- Select a restore point according to the documented RPO and verify that it is still inside its retention period.
- Restore into an isolated test network or account, never directly over production.
- Retrieve the required encryption keys through the documented emergency path and confirm decryption.
- Validate file counts, database consistency, application startup, identity dependencies, and user access.
- Measure elapsed recovery time and the age of the restored data against the RTO and RPO.
- Record failures, assign owners, correct the runbook, and repeat until the result is reliable.
Run file-level checks for ordinary data and application-aware checks for databases and transactional systems. Include a scenario in which production credentials are unavailable; otherwise the exercise does not test the isolation that is supposed to defeat ransomware.
8. Document and exercise the recovery plan
Keep a concise runbook in a protected location that is accessible during a production identity outage. It should list contacts, approval authority, restore order, vault and media identifiers, key-retrieval steps, network isolation requirements, clean-room or recovery-account details, and validation checks.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Include golden images, software installers, license information, configuration exports, certificates, and vendor support contacts. Assign owners from IT, security, and business operations, then rehearse the plan together. A technical restore that does not return the business service to an approved state is not a completed recovery.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Immutable cloud storage versus offline media
Both approaches can meet the isolation requirement, but their operational trade-offs differ.
| Criterion | WORM-locked cloud vault | Disconnected encrypted media |
|---|---|---|
| Resistance to network attack | Strong when the vault account, permissions, and keys are separate from production | Strong while physically disconnected |
| Restore speed | Usually faster for large remote environments, subject to network throughput and service limits | Depends on shipping, handling, connection, and read speed |
| Retention flexibility | Supports policy-based retention; S3 Object Lock also supports fixed, variable, and indefinite protection, while legal holds can preserve selected objects | Managed by rotation, labels, and physical custody; changing retention requires handling the media |
| Scale and geographic redundancy | Can span accounts or regions according to the service design | Requires additional devices and deliberate off-site storage |
| Auditability | Detailed service logs can record reads, deletes, policy changes, and administration | Requires manual chain-of-custody and connection records |
| Primary failure mode | Misconfigured identity, key, retention, or account separation | Lost, damaged, unencrypted, mislabeled, or never-reconnected media |
The choice is not either-or for critical systems. A locked vault provides frequent versions and automated replication; offline media provides a recovery path when cloud credentials, networks, or control planes are under attack.
Common design failures and fixes
| Symptom | Why it fails | Corrective action |
|---|---|---|
| Backups were encrypted along with production | The repository used the same network path or administrator credentials | Move a copy to a separate account or subscription, enforce WORM retention, and add an offline rotation |
| An administrator can delete the “immutable” vault | Immutability was only an application setting, or the storage account owner was shared with production | Use storage-enforced Object Lock or vault locking and remove production deletion privileges |
| Retention expired before discovery | The window was shorter than the attacker’s dwell time and investigation period | Extend retention based on detection and legal requirements; use legal holds for selected evidence |
| Restore stops at an encrypted or missing key | Key management was not separated and the emergency path was never tested | Protect key backups separately and include key retrieval in every restore test |
| Jobs succeed but applications will not start | Only files were checked; identity, configuration, licenses, or database consistency were omitted | Use application-aware restores and validate dependencies in an isolated environment |
| The offline drive is always plugged in | It is exposed to the same malware and credentials as production | Disconnect it after each verified job and maintain a documented rotation |
| No one knows which copy to restore | Inventory, priorities, and ownership were not documented | Publish a restore order with owners, RPO/RTO targets, and approval steps |
How to operate the system during a ransomware incident
- Contain first. Isolate affected endpoints, suspend suspected credentials, and preserve evidence. Do not connect offline media to a potentially infected host.
- Protect the recovery copies. Confirm that retention, legal holds, vault permissions, and encryption keys have not changed. Export audit evidence to a separate incident location.
- Establish a clean recovery environment. Use a known-good identity and network segment, rebuild from trusted images, and apply security updates before restoring business data.
- Select a restore point. Choose the newest point that predates compromise, using malware scanning, endpoint timelines, and application validation rather than timestamp alone.
- Restore in dependency order. Recover identity and core services first, then databases and applications, then file and user data. Keep production isolated until validation is complete.
- Verify and document. Confirm integrity, access, licensing, and business-owner acceptance. Record the actual RPO and RTO, the failed controls, and the changes required before normal operations resume.
What “good” looks like
A ransomware-resistant backup design has several independent properties: multiple copies on different failure domains; encryption with separately governed keys; at least one copy that is offline or logically isolated; storage-enforced WORM retention; administration that production credentials cannot override; alerts for policy and access changes; and repeatable, measured restores.
No immutable setting can compensate for missing data, malware that predates the backup, expired retention, lost keys, or an untested runbook. Review the architecture whenever applications, identity systems, cloud accounts, retention obligations, or recovery objectives change, and schedule restore exercises often enough that the procedure remains familiar to the people who must execute it under pressure.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
