How to protect backups from ransomware — before attackers exfiltrate your data, not after. Immutability, air gaps, root access, and the vendor questions that actually matter.

This is an encore episode, and it earned that spot honestly — it's one of the most listened-to episodes in the show's history, with people sticking around for the whole thing and coming back for seconds. That's a real signal, not just a download count.

Ransomware groups figured out a while back that a good backup system lets a company walk away from a ransom demand. So they adapted: now a lot of the big attacks steal your data before they ever touch encryption. Once that data's out, no backup fixes it. Curtis and Prasanna spend this episode working through what that shift means for how you actually protect your backups.

They get specific. What does "immutable" really mean, and why does root access quietly break most vendors' claims about it? What's the difference between a virtual air gap and a real one, and when does each make sense? What should you know about S3 object lock, including the weird edge case of what happens if your account or credit card stops working? And since more than half of hacks trace back to compromised credentials, what should your vendor be able to undo if an attacker gets into an admin account?

They also cover bit rot — rare, but nasty when it happens silently — and close with a practical list of questions to bring to your own vendor conversations.

If you're responsible for backup or disaster recovery, or you just want to pressure-test your current setup, this one's worth the full runtime.

Chapters:
00:00 – Cold Open: Ransomware Is After Your Backups
01:19 – Welcome & Banter
05:50 – Topic Setup: Protecting Backups from Ransomware
07:36 – The Extortion & Exfiltration Playbook
15:25 – What Is an Air Gap?
18:22 – Virtual Air Gaps
27:57 – Real (Physical) Air Gaps
28:12 – What Is Immutability, Really?
29:23 – Bit Rot
30:42 – Root Access & the Limits of Immutability
32:51 – S3 Object Lock
40:20 – Questions to Ask Your Backup Vendor
42:31 – What Happens If You Delete Your Account?
44:29 – Compromised Credentials & Worst-Case Scenarios
46:41 – Final Thoughts
The Backup Wrap-Up is written, recorded, and produced by W. Curtis Preston. For backup or DR consulting, content generation, or expert witness work, check out backupcentral.com — you'll also find links to his O'Reilly books there. This is an independent podcast; opinions are the speaker's own, not necessarily an employer's.