What does backup immutability cost?

Once you understand how malware attacks work and know that backups are a primary target, there is usually no shortage of motivation to actively protect your backup infrastructure. The question is how to go about it to get a satisfying result, and what it will cost. Remember that backup security is the outcome of many measures, not a single factor. Still, I will show you a shortcut that delivers the most benefit to begin with: immutable backup repositories.

What is backup immutability?#

"Backup immutability is the ability of a backup system to guarantee that the copies it creates remain intact (unchanged), undeletable and ready to restore for the entire required retention period – regardless of hardware failures, human error or deliberate attacks."

Source of the definition: viability.pl/en/blog/immutable-backup

If backups are to be effectively untouchable for a set period of time, the question is how to achieve that in practice.

Key success factors in backup security#

Backup security comes from the combination of four areas:

• System architecture. Designing and building the backup system according to the Secure by Design approach, where security is the foundation of the project rather than an afterthought. Segmentation is key: placing the backup system and repository in separate network zones to minimise the attack surface and limit the reach of a potential breach.
• A secure repository. That is, storage – today a server or a cloud service – that honours the retention policy of your backup jobs. What matters is that the immutability mechanism is native, built into the file system, storage or API, and not provided solely by the backup software (which can be uninstalled).
• Limiting privileges. Applying the principle of least privilege and a Zero Trust policy. In practice, this means creating accounts with just enough permissions to do their job. On top of that, you assume up front that a breach will happen, so every access requires verification, and critical operations such as deleting backups should require approval from two people (the four-eyes principle).
• Backup testing. Regular restores and data integrity checks, plus preventive scanning with an antivirus engine.

A secure repository – what does that mean?#

A backup repository must guarantee data immutability, most often through a WORM (Write Once Read Many) mechanism or an equivalent. Not forever, of course, but in line with your backup policy. Specifically, retention determines how long you keep backups. With 30-day retention you can go back to the state of your data from a month ago. If you detect a security incident or an error after 31 days, that state of your data no longer exists.

So which repository will meet these goals best on a reasonable budget? Here are examples that differ in cost model: on-premises is mostly CapEx (hardware and licences), while cloud is OpEx (subscription). Both paths lead to the same goal.

• On-premises repository:
  • Veeam Hardened Repository (universal),
  • Scality ARTESCA (universal).
• Cloud repository:
  • Object Storage – AWS S3 or Azure Blob (universal),
  • Veeam Data Cloud Vault (for Veeam),
  • Veeam Cloud Connect (for Veeam).

How to start and gain a lot quickly?#

You will get the most results for the least effort by storing backups locally on an immutable repository and, in addition, copying them to a repository outside your premises (off-site backup). This way your data is protected against a large group of typical attack vectors.

If your backup system comes from Veeam, you can choose the natively supported Veeam Cloud Connect (services delivered by Veeam partners) or Veeam Data Cloud Vault (a service based on AWS and Azure, offered by Veeam). If your backup system comes from another vendor, you can always use remote object storage in the cloud (S3 Object Storage). Which option is the cheapest and which one is worth choosing? More on that in the next section.

How much does backup security cost?#

Backup is essentially data redundancy: making backups means duplicating the state of production data and the systems that serve it. Once you factor in retention, and even the savings from deduplication and compression, backups may still need two or even three times more storage than the primary data.

Time for some numbers. Let's assume 20 TB of production data, which with 30-day retention means a 50 TB backup repository should be enough. Below are options that meet these requirements. Prices are net amounts in Polish zloty (PLN), as on the Polish market.

On-premises repositories#

Cloud repositories#

Conclusions#

As you can see, the cheapest way to get an immutable repository is an on-premises Veeam / Linux Hardened Repository. What's more, if you use an older, decommissioned server, the investment comes down to the cost of HDDs and electricity. Immutable storage at PLN 22 per 1 TB is the cheapest option available (for block storage).

If CapEx is not an option, or you need an immutable repository up and running within an hour, the cloud offers widely available S3 Object Storage. For typical backup use, this type of repository should not cost more than PLN 45 per 1 TB per month.

* A small server can draw a constant 250 W, which at Polish electricity prices (~PLN 1.00/kWh) comes to approx. PLN 108 per month (in this example it adds about PLN 2 / 1 TB / month to the storage price).

You can read about other measures that strengthen backup security, and thus cyber resilience, in my article on the company blog.