Architecture · Resilience
Backup Architecture
A layered protection design that survives ransomware: local speed, secondary media, offsite distance and an immutable, credential isolated copy.
AdvancedUpdated 2026-09-01
Overview
The architecture separates recovery speed from recovery certainty. Local copies restore quickly; secondary and offsite copies survive site loss; an immutable or offline copy survives an attacker holding administrative credentials.
Credential isolation is the decisive design choice. If production identity can delete the backups, the backups are part of production's blast radius.
Sequence
- 1Production
- 2Local backup repository
- 3Secondary copy (different media)
- 4Offsite / cloud copy
- 5Immutable or offline copy
Layer model
Components
Backup server and proxiesHardened repository with immutabilityObject storage with lockTape or air gapped copySeparate catalogue backup
Controls
Separate identity domain or local accounts with MFANo production domain admin accessRetention lock preventing early deletionEncryption with keys held apart
Assurance
Automated restore verificationQuarterly full application restore testAlerting on job and retention changesDocumented recovery runbooks
Design considerations
- Size for restore, not for backup, an eight hour RTO requires restore throughput, not just nightly job success.
- Cover SaaS data explicitly, including mailboxes, sites and chat where regulation or risk requires it.
- Keep the backup catalogue itself protected and recoverable.
Security considerations
- Isolate backup credentials from production; enforce MFA on the console.
- Make at least one copy immutable and verify immutability, rather than trusting configuration.
- Alert on any retention reduction or job deletion.
Failure points
- Backup server domain joined to production
- Single repository
- Catalogue loss
- Untested restores