Immutable Backup
also called Object Lock, WORM
A backup that cannot be modified or deleted for a defined retention period, even by an administrator — the control that makes backups survive ransomware and insider error.
Conventional backups share a failure mode: the credentials that manage production can usually also delete the backups. Ransomware operators know this and target backup systems first; the same exposure covers a mistaken script or a disgruntled administrator.
Immutability removes it at the storage layer. Object lock in compliance mode prevents deletion for the retention period regardless of permissions — including by the account root. The data can be read and new versions written; the existing copy cannot be removed until the clock expires.
Design points. Governance mode versus compliance mode matters: governance mode allows a sufficiently privileged user to override, which defeats the control against a credential compromise; compliance mode cannot be overridden by anyone, which is the point and means a mistake in retention is permanent and billable.
Combine with account separation. Immutable backups in a separate account or subscription, with a distinct identity path, defend against both deletion and the credential that could reconfigure the policy.
Retention must exceed detection time. Ransomware frequently dwells for weeks before triggering, so a seven-day immutable window may protect only backups that are already encrypted. Retention should be set from realistic dwell time, not from storage cost.