Backup vault (immutable backup): what it is and how it is attacked
A copy of your data held so that it cannot be changed or deleted for a set period, including by an administrator, for as long as the retention lock is genuinely in force.
Also known as
- immutable backup
- offline backup
- air-gapped copy
Typing any of them into the editor finds this object.
Why it matters on a security diagram
It is the control that decides whether operations can be restored without paying, because it is the copy the encryption could not reach. It does nothing about data already copied out, which is why recovery and disclosure are two separate problems.
How it gets attacked, and what reduces it
How it gets attacked
- Retention locks not actually enabled
- The only copy sitting on the same network as the live data
What reduces it
- Confirm the retention lock is actually enabled, not merely available
- Keep the copy off the network and under different credentials from production
- Retain for longer than the time an intruder was present, or every surviving copy contains them
Where it sits
- Group
- Storage · Where data sits still.
- Whose side, by default
- Ours · Belongs to the organisation the diagram is about.
- Catalogue identifier
- backup-vault
Reviewed . CC BY 4.0.
Others in storage
- Shared file storeNAS · network attached storageA box on the network that holds shared files.
- Storage networkSAN · storage area networkA high-speed network whose only job is connecting servers to disks.
- Cloud storageS3 · blob storage · bucket · object storage · cloud file storageA pool of files kept in a cloud platform, each one labelled and fetched by name rather than filed in folders.
The storage group lists all 4 of them side by side.
Backup vault on your own diagram
Open the editor, press N, and type immutable backup. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram maker