Backups are a security control, not an IT chore

A backup that the attacker can delete is not a backup. Modern ransomware operators look for backup consoles first, because destroying them is what turns an incident into a payout.

Follow 3-2-1, and add one

Three copies, on two kinds of media, one off-site. Then add the extra “1”: at least one copy that is immutable or offline, so that no credential on your network can alter it.

Separate the credentials

Backup systems should not trust your main directory. If a domain admin account can log into the backup server, so can whoever steals it.

Test restores, not jobs

A green “job succeeded” tells you data was written somewhere. Only a timed restore tells you the business can come back. Pick a system each month and restore it for real.