Protect backups from ransomware

Name: How to Protect Your Company's Backups from Ransomware with Immutable Object Storage
Brand: OVHcloud
Rating: 4.8 (476 reviews)

Protect your backups from ransomware with immutable storage

Modern ransomware deletes your backups before encrypting production. Without a clean copy, the only options are paying the ransom or rebuilding from scratch. OVHcloud Object Storage with Object Lock makes backups impossible to delete until retention expires, even with compromised admin credentials.

Discover Object Storage Read the documentation

Attackers disable backups before encrypting data

Ransomware operators locate your backup repository, steal credentials, and wipe copies before triggering the production payload. A business that can restore has little incentive to pay; one whose backups were wiped has no choice. A single account with write access can erase every object in minutes, unless the storage layer refuses that instruction.

Object Lock: backups the storage layer refuses to delete

WORMS3-compatible

Object Lock is enforced at the storage layer, not inside your backup software. Every delete or overwrite request is refused until the retention period expires, including requests with valid administrator credentials.

Versioning preserves each earlier version, so an object altered before the lock takes effect still has a clean, restorable history. Enable both when you create the bucket.

Discover Object Storage Read the documentation

Isometric illustration of immutable cloud backup storage with locked object containers, replicated regional nodes and security shields, blue and cyan

The four-layer protection model

Object Lock (WORM)

Refuses every delete or overwrite until retention expires, including by admin accounts. Irreversible once set. Legal Hold adds an indefinite lock on individual objects

Versioning

Preserves every prior version instead of replacing in place. A file altered before the lock still has a clean, restorable history. Required for Object Lock to function

S3 Async Replication

Automated copy in a separate region, independent of primary credentials. No manual transfer. The locked state follows each object to the destination

Encryption at rest

SSE-C for self-managed keys; SSE-OVHcloud Managed Keys for delegated lifecycle. Encrypted objects are unreadable if an attacker reaches the storage layer.

Four reasons to choose immutable storage

Every layer works together so one compromised credential can't destroy your recovery.

Backups that survive a compromised admin

Immutable backups, Object Lock enforced

Isolated copy in a separate region

3-2-1 backup with immutable object storage

No egress fees on restore

Restore from ransomware at predictable cost

Sovereign EU infrastructure, no CLOUD Act

Immutable backups on sovereign EU storage

._mobileContent_vzuld_120 { display: block !important; } ._contentPanel_vzuld_142 { display: none !important; } ._layout_vzuld_5 { display: flex !important; flex-direction: column !important; }

OVHcloud Object Storage is Veeam Ready certified; HYCU, Cohesity and Veritas NetBackup are compatible via the S3 API. Configure immutability in your tool: Object Lock enforces retention at the storage layer independently, even if the application is compromised. For Kubernetes, Velero and CloudCasa both work. The integration is an endpoint change, not a re-architecture.

Use awscli, Rclone, Restic, Duplicati or Plakar. A pipeline tested locally moves to production with only an endpoint change. Enable Object Lock and versioning at bucket creation, the storage layer enforces retention independently of your script.

Velero and CloudCasa both support OVHcloud Object Storage as a backup target via the S3 API. Persistent volumes are protected with immutability configured directly against the bucket, Object Lock enforces retention at the storage layer, independently of the application. Compatible with OVHcloud Managed Kubernetes Service.

A second copy in a separate region, out of reach

Anti-affinity3-2-1 backupDistant backup

A backup stored alongside production shares its credentials and blast radius.

S3 Async Replication keeps an automated copy in a separate OVHcloud region, independent of primary credentials. Combined with Object Lock, an attacker must compromise two regions to destroy every restore path. No manual transfer is required.

Discover Object Storage

Operational best practices to keep your restore path intact

Enforce MFA on every account that can change a retention policy

MFA breaks the credential-replay step ransomware depends on. Require it on the storage console and every account that can modify a retention policy. Store service credentials in a password manager. Monitor delete attempts: a spike in refused deletions is an early signal of compromise.

Run restore drills before an incident forces you to

Test your recovery path before an incident does. Schedule regular restore drills and document the results. Insurers increasingly ask for this evidence at renewal. An untested backup is an assumption, not a guarantee.

Tier storage classes to control long-term retention cost

Lifecycle policies move objects from Standard to Active Archive then Cold Archive, while Object Lock stays in force across all tiers. Keep a multi-year immutable retention policy without paying premium rates throughout.

Get protected in four steps

Create a bucket with Object Lock enabled

Object Lock must be activated when you create a bucket and cannot be added later. Enable versioning at the same time. Set the default retention period to match your recovery objectives

Point your backup tool at the endpoint

Veeam, Rclone or awscli: an endpoint change is all that is needed. The storage layer enforces retention independently

Enable cross-region replication

S3 Async Replication keeps an automated copy in a second region with no manual transfer or shared credentials between regions

Run a restore drill and document it

Restore a real backup from the immutable bucket and record the result. This validates the recovery path and satisfies audit requirements

Prove immutability to insurers and auditors

Cyber-insurance renewals now ask directly: are copies immutable, isolated, and can you show a restore test? Those who can't answer with evidence face higher premiums or declined coverage. ISO 27001 audits and customer questionnaires follow the same logic. OVHcloud Object Storage runs on EU infrastructure with ISO 27001/27017/27018/27701 certification and no CLOUD Act exposure.

Start with a free trial, restore before you commit

Enable Object Lock, run one backup job, restore it. The trial covers the test and the proof.

Start your free trial