Ransomware-resistant backup architecture is no longer optional — it's expected by every UK regulator + insurer. The three production-grade approaches are WORM, S3 Object Lock, and hardened Linux. This explainer covers what each does, when to use it, and the gotchas Servnet sees in UK deployments.
Why immutable matters
Modern ransomware actively targets backup. Once attacker gains domain admin, they look for backup software + storage + try to encrypt or delete backups before encrypting production.
Without immutability: backup encrypted = no recovery = pay ransom.
With immutability: backup cannot be modified or deleted (even by admin) for the configured retention window. Recovery without paying ransom is possible.
Architecture 1 — WORM (Write Once Read Many)
Hardware-based immutability — typically NetApp SnapLock, Dell PowerProtect WORM, or DataDomain Retention Lock.
Strongest guarantee — hardware enforces immutability at storage layer.
Most expensive option. Best for highly-regulated workloads (FS, healthcare critical records).
Operational complexity — restore + retention extension require specific procedures.
Architecture 2 — Object Lock (S3, Azure Blob, GCS)
Software-based immutability at object level — AWS S3 Object Lock, Azure Blob Storage immutable, Google Cloud Storage Bucket Lock.
Cloud-native. Pay for storage + egress. Excellent ransomware posture.
Veeam, Rubrik, Commvault all support S3-Compatible Object Lock targets.
Modern default for UK mid-market backup architecture.
Architecture 3 — Hardened Linux Repository
Linux server with: SSH disabled or via certificate-only, xfs / ext4 with immutable file attribute (chattr +i), single-use credentials, file-system audit logging.
Veeam-specific (Veeam Hardened Linux Repository) — most-deployed immutable architecture for Veeam customers.
Lowest cost (uses standard Linux servers).
Gotcha: requires Linux operational discipline. Single-use credentials must be genuinely single-use.
The 3-2-1-1 rule
3 copies of data — production + 2 backups.
2 different media types — disk + tape or disk + cloud object storage.
1 offsite copy — geographically separated.
1 immutable copy — protected from ransomware encryption / deletion.
What Servnet does
Servnet deploys all three immutable architectures across UK customers — see our backup buyer's guide for the upstream platform choice.