Object First's secure, simple, powerful backup storage solution features Absolute Immutability, meaning Zero Access to destructive actions. No one—not even the most privileged admin or a fully compromised attacker—can modify or delete backup data once written.
96% of organizations hit by ransomware in the past two years had their backup data targeted, making robust data protection more important than ever.
The same research revealed 81% of IT professionals say immutable backup storage built on Zero Trust principles is the best defense against ransomware.
Read on to find out why immutable storage offers the best chance of recovery in the case of a cyber attack or other data loss incident.
The purpose of immutable storage is to prevent data from being modified, deleted, or overwritten for a set period once it has been written. In principle, a file committed to immutable storage stays in its original state for the duration of its lock, and no user command, application, or process can change it during that time. The concept originates in physical media such as write-once optical discs, where the constraint was a property of the hardware. It is now implemented in software, on-premises and in cloud object storage, which allows it to be applied at scale to backup data. Unlike production storage, where applications must constantly create, modify, and delete data, immutable storage is designed to preserve data in an unchanged state for protection, recovery, and compliance purposes.
The purpose of immutable storage is to prevent data from being modified, deleted, or overwritten for a set period once it has been written. In principle, a file committed to immutable storage stays in its original state for the duration of its lock, and no user command, application, or process can change it during that time.
The concept originates in physical media such as write-once optical discs, where the constraint was a property of the hardware. It is now implemented in software, on-premises and in cloud object storage, which allows it to be applied at scale to backup data.
Unlike production storage, where applications must constantly create, modify, and delete data, immutable storage is designed to preserve data in an unchanged state for protection, recovery, and compliance purposes.
Immutable data storage operates on a Write Once, Read Many (WORM) model. Data is committed once and locked against modification and deletion for a defined retention period. The retention period, as used by most backup applications, fixes an expiry data for immutability at the time the backup is created. Less commonly, some also allow a "legal hold" creating an open-ended lock that remains in force until an authorized user explicitly removes it. But the critical requirement for a robust backup solution is that the backup software and S3 Object Storage work together to ensure that backup data remains immutable for the entire retention period, and that period cannot be changed after the backup is written. This bolsters defenses against ransomware and disaster recovery, because attackers cannot delete or encrypt backups, ensuring a clean copy is always available to restore from. In object storage, the mechanism that enforces this is S3 Object Lock , which operates in one of two modes. Governance mode applies the lock but allows a sufficiently privileged user to shorten retention or remove it, while compliance mode allows no such override. As we will see, this is a very significant distinction. In the backup storage context, S3 Object Lock needs to be configured in compliance mode to ensure immutability. In governance mode, anyone who acquires the necessary privileges, administrator or attacker, would be able to modify or delete backup files that were supposed to be “immutable” – even during the retention period.
Immutable data storage operates on a Write Once, Read Many (WORM) model. Data is committed once and locked against modification and deletion for a defined retention period.
The retention period, as used by most backup applications, fixes an expiry data for immutability at the time the backup is created. Less commonly, some also allow a "legal hold" creating an open-ended lock that remains in force until an authorized user explicitly removes it. But the critical requirement for a robust backup solution is that the backup software and S3 Object Storage work together to ensure that backup data remains immutable for the entire retention period, and that period cannot be changed after the backup is written.
This bolsters defenses against ransomware and disaster recovery, because attackers cannot delete or encrypt backups, ensuring a clean copy is always available to restore from.
In object storage, the mechanism that enforces this is S3 Object Lock , which operates in one of two modes. Governance mode applies the lock but allows a sufficiently privileged user to shorten retention or remove it, while compliance mode allows no such override. As we will see, this is a very significant distinction. In the backup storage context, S3 Object Lock needs to be configured in compliance mode to ensure immutability. In governance mode, anyone who acquires the necessary privileges, administrator or attacker, would be able to modify or delete backup files that were supposed to be “immutable” – even during the retention period.
Immutable storage is a critical pillar of data security that comes in two primary forms: cloud-based and on-premises. • Cloud Immutable Storage : Offered by cloud storage providers, this type enables scalable, remote data protection. Services like Veeam Data Cloud Vault, Amazon S3 Glacier and Microsoft Azure Blob Archive are prime examples of platforms where data is safeguarded in a cloud environment, accessible anywhere, and shielded from local disasters. • On-Premises Immutable Storage : Includes solutions like on-premises object storage , where data is stored locally on a physical device. On-prem S3 object storage solutions offer the highest levels of data sovereignty and quick access, while providing native immutability features.
Immutable storage is a critical pillar of data security that comes in two primary forms: cloud-based and on-premises. • Cloud Immutable Storage : Offered by cloud storage providers, this type enables scalable, remote data protection. Services like Veeam Data Cloud Vault, Amazon S3 Glacier and Microsoft Azure Blob Archive are prime examples of platforms where data is safeguarded in a cloud environment, accessible anywhere, and shielded from local disasters. • On-Premises Immutable Storage : Includes solutions like on-premises object storage , where data is stored locally on a physical device. On-prem S3 object storage solutions offer the highest levels of data sovereignty and quick access, while providing native immutability features.
Immutable storage is a critical pillar of data security that comes in two primary forms: cloud-based and on-premises.
• Cloud Immutable Storage : Offered by cloud storage providers, this type enables scalable, remote data protection. Services like Veeam Data Cloud Vault, Amazon S3 Glacier and Microsoft Azure Blob Archive are prime examples of platforms where data is safeguarded in a cloud environment, accessible anywhere, and shielded from local disasters.
• On-Premises Immutable Storage : Includes solutions like on-premises object storage , where data is stored locally on a physical device. On-prem S3 object storage solutions offer the highest levels of data sovereignty and quick access, while providing native immutability features.
Standard vs. Absolute Immutability
Some solutions marketed as offering ‘ immutable backups ’ offer only policy-based immutability. As we have seen above, that is insufficient for full backup protection, as any account with enough privilege can simply shorten the retention period or disable it—including an attacker with the right credentials.
Absolute Immutability is different. It enforces Zero Access to destructive actions across the entire storage stack, including firmware, OS, software, and the backups themselves. No one—not even the most privileged admin or a fully compromised attacker—can modify or delete backup data. Absolute Immutability ensures your backups will still be available, unchanged, when you need them - your last line of defense in a system failure or ransomware attack.
To achieve Absolute Immutability requires adherence to three core principles:
1.S3 Object Storage: A fully documented, open standard with native built-in immutability that enables independent penetration testing and verification. Compliance Mode must be enforced at all times to ensure Zero Access to destructive actions.
2.Zero Time to Immutability: Backup data must be immutable the moment it is written.
3.Target Storage Appliance: A dedicated target storage appliance securely segments storage from backup software, and removes the risks associated with DIY self-managed backup storage during operations—particularly during setup, updates and maintenance. It requires little-to-no security expertise from a customer and shifts full responsibility to a vendor.
The Role of Storage Immutability Across Industries
Immutable storage is an essential pillar of data security for many industries, especially those subject to stringent laws around data protection:
Preserving video and audio surveillance is crucial for legal proceedings. Immutability helps maintain chain of custody by ensuring digital evidence remains unchanged after collection, supporting its integrity and admissibility in court.
Immutable storage safeguards healthcare backups against unauthorized modification or deletion, supporting compliance with HIPAA and other healthcare data protection regulations.
Ensuring financial records remain accurate and unmodifiable is crucial for audit transparency. Immutable storage helps financial institutions meet record retention and cyber resilience requirements under FINRA , SEC 17a-4 , DORA and related regulations.
Immutable storage helps educational institutions protect student records and research data while supporting compliance with FERPA , GDPR and other data protection regulations.
Immutable storage is used to meet the Freedom of Information Act requirements in the US, preserving the accuracy and accessibility of government records for public scrutiny. This practice supports transparency and accountability by preventing unauthorized alterations.
Immutable storage is used to meet the Freedom of Information Act requirements in the US, preserving the accuracy and accessibility of government records for public scrutiny. This practice supports transparency and accountability by preventing unauthorized alterations.
Learn how MFL increased backup speeds by 15% and achieved NIS2 compliance with absolutely immutable backup storage from Object First.
6 Key Benefits of Immutable Storage for Enterprises
Immutable storage is a cornerstone of modern data management. Not only do immutable backup solutions form part of the 3-2-1-1-0 backup rule , but when implemented properly with Absolute Immutability they provide additional protection against cyberattacks, accidental deletion, and other threats to data integrity:
Robust Defense Against Ransomware
Robust Defense Against Ransomware
Immutable backups protected by Absolute Immutability provide the best protection against ransomware . Because stored data cannot be altered, encrypted or deleted, organizations can restore data from clean recovery points without paying a ransom.
Protection Against Human Error
Protection Against Human Error
Accidental deletions, misconfigurations, and other administrative mistakes cannot compromise protected data, helping preserve business continuity and recovery readiness.
Compliance with Data Regulations
Compliance with Data Regulations
Absolute Immutability helps organizations meet data retention, integrity, and auditability requirements across a wide range of regulatory and industry frameworks.
Long-Term Data Integrity
Long-Term Data Integrity
Protection Against Human Error
Protection Against Human Error
Accidental deletions, misconfigurations, and other administrative mistakes cannot compromise protected data, helping preserve business continuity and recovery readiness.
What Is an Immutable Backup?
An immutable backup is a secure data copy that cannot be changed or deleted, using mechanisms like S3 object lock and WORM to prevent tampering for a set period, thus offering a strong layer of protection for critical data. Backups with Absolute Immutability—meaning that not even the most privileged admin or attacker can modify or delete your backup data—are your best protection against ransomware.
How Much Does Immutable Storage Cost?
The cost of immutable storage depends on several factors, such as the volume of data, the length of the retention period, and whether you choose cloud-based or on-premises solutions, with prices varying widely based on provider and service specifics. Some on-prem providers offer flexibility and predictable monthly billing in the form of pay-per-use Consumption models .
Can Immutable Storage Be Used for Compliance?
Immutable storage is ideal for maintaining stringent regulatory compliance requirements with legislation like DORA and NIS2, as immutable storage ensures data cannot be altered once written, thereby upholding industry regulations and legal standards.
How Does Immutable Storage Support Data Recovery?
Immutable storage is fundamental for robust data recovery strategies, providing reliable, unchanged data backups that can be readily accessed after incidents like cyberattacks or system failures, minimizing operational disruption.
Can I use more than one approach to Storage in my backup strategy?
You not only can, but should! For a long time, most backup architecture was based on the “3-2-1" rule: 3 copies of your data (1 production and 2 backup), on at least 2 different types of storage media, with one copy stored offsite.
More recently, the importance of backups as a cyber security defense, and the fact that backups are actively targeted by ransomware attackers in almost all attacks, have led to an expanded rule: 3-2-1-1-0. This adds requirements that one copy is absolutely immutable or air-gapped, and that regular restore testing shows zero errors in the backups.
So based on your RPO and RTO targets for data in your different workloads (the amount of data you can afford to lose and the time it takes to restore your data from backup) you should build a backup strategy using different types of storage that meets the 3-2-1-1-0 rule making the most appropriate and cost-effective use of different types of storage. Using Absolutely Immutable, on-premises backup storage as your primary target for backup storage helps you meet this rule efficiently, and also ensures rapid recovery of your data when needed.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
