Ransomware operators who compromise a city's workload account may t…

Question

Ransomware operators who compromise a city's workload account may try to delete local snapshots and backups. Which backup design best keeps archives recoverable after that pattern?

Accepted Answer

Use immutable / vault-lock style backups (for example AWS Backup Vault Lock or equivalent WORM controls), preferably with cross-account or logically air-gapped retention that blocks early deletion. — If the burglars get the building keys, ordinary snapshots in that same building can vanish. Immutable vault locks—and ideally a copy the attackers cannot erase—keep the archive recoverable.

Answer

Store all snapshots only in the same compromised account with unrestricted IAM delete rights for every operator role.

Answer

Disable backups entirely to reduce the number of objects attackers might delete.

Answer

Email nightly database dumps to a shared municipal mailbox as the sole recovery copy.

Ransomware operators who compromise a city's workload account may try to delete local snapshots and backups. Which backup design best keeps archives recoverable after that pattern?

Short Explanation

Full Explanation