Threat-model the backup

Backups are valuable targets. Ransomware crews go for them first, because a victim with working backups doesn’t pay. So the backup system needs a threat model, the same way the live system does.

The core question is: who can delete or read my backups, and from where?

Start with the worst realistic case. An attacker with your server’s credentials may delete both the live data and every recovery point. If the server holds a credential that can write and delete backups, then whoever owns the server owns your backups too.

Build a threat table

Write a table with one row per scenario:

threat: compromised server
path: backup credentials readable by root
control: append-only or separate deletion credentials
recovery test: restore from protected snapshot

The path column forces honesty. Exactly how would this threat reach the backups? The control column names the defense. For a compromised server, the standard controls are append-only storage (the server can add snapshots but never remove them) or split credentials, where the delete permission lives on a separate administrator account the server never sees.

Now add the quieter threats. Each gets its own row:

threat: accidental deletion       control: version history, retention
threat: silent corruption          control: integrity checks, checksums
threat: lost backup password       control: escrowed key, second keyholder
threat: expired cloud account      control: billing alerts, second provider
threat: unavailable restore tool   control: documented versions, offline copy
threat: legal retention needs      control: written policy, immutable storage

The boring rows matter most. Far more backups die from an expired credit card or a forgotten password than from attackers.

No single control covers everything

Encryption protects confidentiality, not deletion. An attacker doesn’t need to read your backups to destroy them. Immutability protects history, not a lost decryption key. Your snapshots can sit safe and unreadable forever.

Every control answers one threat and ignores the others. That’s why you need the whole table, not one favorite defense.

Try this on your own setup. Fill in the path column for each row. If you write “not sure”, that’s a finding. The next lessons give you controls for most of these rows.