In many ransomware incidents, attackers do not break the backup software — they simply log in. Protecting backup credentials is one of the highest-value steps you can take.
Core controls
- MFA on every backup console and storage interface.
- Role-based access control so no single admin can do everything.
- Separate identities for backup administration, not domain admin accounts.
- Four-eyes approval for destructive actions such as deleting backups or shortening retention.
Reduce the blast radius
Keep backup infrastructure out of the main identity domain where practical, restrict management networks and monitor for unusual administrative activity.
Why it matters: immutability protects data from change; strong access control stops attackers reaching the controls in the first place.
Quick wins you can make this month
- Enable MFA on every backup console, storage appliance and cloud backup account.
- Remove shared or generic administrator accounts.
- Review who has rights to delete backups or change retention.
- Separate backup administration accounts from domain administrator accounts.
- Alert on destructive actions such as bulk deletion or policy changes.
These steps cost little but close the most common route attackers use to destroy backups.
Key takeaways
- Treat backup admin accounts as crown jewels.
- Require approval for destructive actions.
- Separate backup identities from production identities.
Want an independent view of your recoverability?
Book a Recovery Readiness Call and we’ll help you turn assumptions into evidence.
