Backups

First principles

A backup is a copy you can stand a system back up from. Three copies (production plus two), on two different media, with one off-site: 3-2-1. Off-site means out of reach of the credentials and the network that can destroy production. Offline or immutable storage is how you get that reach to fail closed.

The control is not the backup job. The job is a write. The control is a restore: pick a date, bring a system back, see that the data is there, write down how long it took. If you have never restored, you have a hope. Ransomware that encrypts the NAS with the same admin you use for the file server is doing you a favour by showing that hope was misplaced.

Same credentials, same blast radius

Domain admin that can log into the backup console is not a backup architecture. It is one identity away from both copies. Immutable object lock, an offline disk you rotate, a cloud account that production cannot write to — those are different identities and different reach. That is the point.

What an admin actually does

• Name what must come back: identity, mail, finance, the systems that mint revenue. Backup those first, not the whole estate as a blob.
• Put a restore on the calendar. A file, a mailbox, a whole host. Record the time. Fix what was slow or missing.
• Split the backup identity from production admin. MFA on the backup console. No standing sync of domain admins into the backup product.
• One copy the ransomware cannot reach: offline, immutable, or a cloud account production roles cannot delete.