Immutable backups trade flexibility for protection
Backups that genuinely cannot be deleted before a set date also cannot be deleted by you.
That is the point and it is a real constraint. Storage costs are committed, mistakes cannot be tidied up, and data you are obliged to erase may be locked in. Those are acceptable trades against the alternative, which is a control your own administrator account can switch off, and therefore so can an attacker holding it.
More on Backups and recovery
- Offline copies break attacker reachabilityReach ends at the last plug
- RPO and RTO answer different questionsTwo different clocks
- Restoring data can restore malware tooThe newest jar is the spoiled one
- Backup credentials deserve separate protectionNot on the same switch
- Recovery order follows dependenciesBottom crate first
- Backup retention determines how far back you can restore to escape corruption or compromiseAs far back as the rope goes