2026 Ransomware Backup Strategy: 3-2-1-1, Immutable Backup & Air Gap Protection
The 2026 design baseline is 3-2-1-1: the classic 3-2-1 rule plus one immutable copy. To make it hold, you need three things together: immutability (WORM), an air gap (isolated recovery environment), and separation of privileges. This guide covers the architecture, setup order, and recovery procedure, based on NetBackup and Flex Appliance documentation.
Veritas recommends a 3-2-1+1 layout: the 3-2-1 strategy plus one immutable copy.
This article draws on the NetBackup Hardening Guide as published on the Cohesity documentation portal (last updated 2026-01-14).
Supported features vary by NetBackup version, appliance model, and license. Re-check against vendor documentation before deployment.
Why Ransomware Goes After the Backup Server First
In ransomware response, backups are the last line of defense, and attackers know it. Before encrypting production servers, they tend to hunt for the backup server, the backup catalog, and storage admin accounts so they can delete or encrypt them first. Veritas's cyber-attack recovery design material (published 2023-10-17) likewise states that attackers target backup data to stop organizations from recovering.
The same material cites a Statista survey showing average downtime after a ransomware attack was 25 days in the first half of 2022 (Confirmed, cited figure). Cybersecurity Ventures projects that by 2031 a business will be hit every 2 seconds, at roughly US$265 billion in annual damage (Estimated, as cited in the Veritas white paper of July 2023).
4 Paths That Block Recovery Even When Backups Exist
If a backup console account is compromised, a legitimate delete command can wipe the backups.
Backup disks or shares that are writable from the production network become encryption targets.
Lose the index that records which backup is where, or the encryption keys, and the data is unrecoverable even though it still exists.
Restoring from a backup taken after infection spreads the same malware again.
These four are general failure patterns compiled by the author. The starting point is to check whether your backup server and storage can be deleted from the production network.
How Immutable Backups Differ From Regular Backups
An immutable backup is locked so its data cannot be changed, encrypted, or deleted for a defined retention period. The NetBackup Hardening Guide describes this as immutable (cannot be changed) and indelible (cannot be deleted) storage, protecting data for a set period or indefinitely (Confirmed, 2026-01-14 edition).
WORM stands for Write Once Read Many: once written, data can only be read. In NetBackup, backup images created while the storage unit and disk pool have the WORM property enabled are set as immutable and indelible, and the WORM settings are configured by the storage administrator outside NetBackup (Confirmed). On Flex Appliance, the same protection is applied by creating a WORM storage server instance.
| Comparison | Regular backup | Immutable (WORM) backup |
|---|---|---|
| If an admin account is stolen | Anyone with permission can delete backups or shorten retention | Images are protected from deletion until they expire (Confirmed) |
| If ransomware reaches the storage | Becomes a target for encryption and deletion | WORM servers are designed to block encryption, modification, and deletion (Confirmed) |
| Changing retention | Adjustable by editing the policy | Cannot be changed during the set period; deleted normally after expiry |
| Where it is configured | Backup software policy | Storage or WORM server settings (storage administrator) |
| Capacity management | Space reclaimed immediately on expiry | Space cannot be reclaimed during retention, so plan capacity in advance |
In the cloud, immutable data can be kept on Veritas Alta Recovery Vault or on object storage from OST (OpenStorage Technology) partners (Confirmed). For detailed procedures, see the NetBackup Hardening Guide.
Required capacity is roughly daily change × retention days. With a daily change of 2TB (assumed), 30 days of retention needs 60TB and 90 days needs 180TB. Immutable data cannot be reclaimed, so estimate your growth rate before adopting it.
The 3-2-1-1 Backup Strategy: Structure and Design
The 3-2-1 strategy means 3 data copies, 2 different media types, and 1 offsite location. Veritas recommends adding one immutable copy that cannot be tampered with or deleted (Confirmed), which this article shortens to 3-2-1-1.
| Element | Purpose | Typical technology | Check question |
|---|---|---|---|
| 3 Copies | Secure data copies | Original and backup replicas | Do at least 2 copies exist besides the original? |
| 2 Media | Media separation | Disk and tape | Can a fault or infection on one medium spread to the other? |
| 1 Offsite | Site-failure protection | Remote backup | Can you restore from the remote site if the primary site is down? |
| +1 Immutable | Prevent tampering and deletion | WORM / immutable storage | Is the copy safe from deletion within retention even if admin accounts are compromised? |
| Air Gap | Cut network attack paths | Isolated backup copy | Is there any path from the production network into this copy? |
An example layout (author's suggestion): keep the first copy on local disk backup, replicate to a remote DR site for the second copy, and hold the third copy on WORM immutable storage or tape. Build a per-copy table to confirm that no single medium holds all copies and that at least one copy is immutable.
Air Gap and the Isolated Recovery Environment (IRE)
An air gap cuts the network path between the backup copy and the production environment. If immutability is a lock that stops deletion and tampering, an air gap removes the attacker's route altogether.
NetBackup's Isolated Recovery Environment (IRE) is configured on a WORM storage server and creates an air gap between the production environment and a copy of the protected data (Confirmed). It requires a production NetBackup environment and a target Flex Appliance with a WORM storage server instance, and no additional configuration is needed on the production side (Confirmed).
Since NetBackup 10.1, the IRE air gap restricts network access at all times and works on both Flex Appliance and BYO (bring your own) deployments (Confirmed, Veritas white paper, July 2023). The Veritas IRE white paper presents no open inbound firewall ports, malware scanning, anomaly detection, MFA, and RBAC as components (Confirmed).
| Item | Immutable | Air Gap |
|---|---|---|
| Threat addressed | Deletion, encryption, or tampering within retention | Access and spread over the network |
| How it works | WORM retention lock | Network isolation (IRE), inbound ports blocked |
| What needs extra cover | Does not block access to or reading of the storage itself | Data enters only at replication time, so replication lag affects RPO |
| Operational impact | Capacity cannot be reclaimed during retention | Large-scale restores need a designed transfer path across the isolation |
| NetBackup implementation | WORM storage server instance | IRE configured on a WORM server |
Storage that is permanently mounted with production credentials, or reachable with a single admin account, is not isolated. An air gap must let you demonstrate by design that no inbound path to the copy exists.
As a next step, list every network path and account that can currently reach your isolated copy.
NetBackup Hardening Order and Privilege Separation
The NetBackup Hardening Guide presents its top recommendations in the following order (Confirmed, based on the guide's table of contents). Detailed settings differ by NetBackup version and appliance type.
- 1Keep software up to date
Keep backup servers, media servers, and appliance OS at the latest security patch level.
- 2Enable multifactor authentication (MFA)
The guide includes SSO integration and smart card or digital certificate authentication.
- 3Implement an immutable data vault
Create a WORM storage server instance and apply immutable, indelible protection.
- 4Secure credentials
Split roles with RBAC and forward audit events to system logs or an external log endpoint.
- 5Reduce network exposure
Narrow management interface access and restrict direct access to the appliance operating system.
- 6Enable encryption
Choose KMS-based encryption and FIPS 140-2 conformance items to match your policy.
Example Role Separation
If a single backup account can change policies, set retention, and run restores, one stolen account becomes a total wipe. The matrix below is the author's suggested separation; adjust roles to your organization's rules.
| Role | Change policy | WORM / retention | Run restore | View logs |
|---|---|---|---|---|
| Backup operator | ○ | × | △ approval needed | ○ |
| Storage / security admin | △ review requests | ○ | × | ○ |
| Recovery (DR) lead | × | × | ○ | △ restore logs only |
| Audit / security team | × | × | × | ○ |
The appliance must be in lockdown mode before you can create a WORM storage instance (Confirmed). Also, a WORM server keeps a copy of the NetBackup catalog in /mnt/msdp/vol0, while the original sits on the dedicated catalog volume (/mnt/msdpcat) (Confirmed).
Action: count how many permissions your current backup accounts hold at once, then see whether they can be split into the four roles above.
Recovery Priorities and the DR Procedure After Infection
The first rule of recovery is securing a clean restore point. Veritas advises scanning backup data for malware before recovery so you restore from a clean copy (Confirmed), and explains that from an IRE you can choose to recover to production, to a different environment, or to systems inside the IRE (Confirmed).
A successful backup log alone does not prove recoverability. The four validation levels and frequencies below are the author's suggestions (examples).
- Image check
- Confirm backup images are healthy; at least monthly is recommended
- Sample restore
- Restore 1 to 2 key servers to a temporary environment; monthly recommended
- Catalog
- Restore the catalog and keys in a separate environment; quarterly recommended
- Full drill
- Run the entire DR scenario in real order; every six months recommended
Separate suspected network segments, cut access to the backup server, and prepare a full credential reset
Estimate the first infection time, affected servers, and whether the backup server itself was compromised
Pick a point before infection, run a malware scan, and prefer immutable or IRE copies
Restore directory services, DNS, and networking, then the backup server and catalog
Start with systems that have the shortest RTO and verify database consistency
Confirm integrity, strengthen monitoring, then reconnect to the production network step by step
Restore time can be estimated from data volume and effective throughput. The figures below are assumptions.
Restore time = data volume to restore ÷ effective restore throughput
50TB ÷ 1GB/s ≈ about 13.9 hours
Assumption (example): 50TB converted as 50,000GB; verification and reconnection time are extra. Actual throughput differs by environment.
Veritas stresses that a plan is only as trustworthy as its last successful test. Measure the throughput in the table above with a real drill this quarter.
Backup Security Checklist and FAQ
Run through these 10 items before adoption or during a review. If 3 or more are unchecked, start by closing those gaps.
- I have confirmed the 3-2-1-1 layout (3 copies, 2 media, 1 offsite, 1 immutable) copy by copy
- Backup servers, media servers, and appliances are kept at the latest patch level
- MFA is enforced on the backup console and appliance admin accounts
- Immutable retention is longer than our breach detection time and regulatory requirements
- Immutable storage capacity has been calculated as daily change × retention days
- No inbound path leads into the isolated (IRE) copy
- Backup operator, storage admin, and recovery lead privileges are separated, and logs are forwarded externally
- Copies of the catalog and encryption keys (KMS), plus their recovery procedure, are stored separately
- Malware scanning of restore points and clean restore point selection criteria are documented
- We have records of the latest recovery drill (date, duration, failed items)
If I have immutable backups, do I still need an air gap?
Immutable backups prevent deletion and tampering during retention, but they do not remove the network paths that can reach the storage. Veritas guides you to configure an IRE on a WORM storage server to create an air gap between the production environment and the protected data copy, so using both methods, which defend against different things, is the recommended setup.
What does the last 1 in 3-2-1-1 stand for?
It means one immutable copy that blocks tampering and deletion, written by Veritas as 3-2-1+1. Add this immutable copy to the base layout of 3 copies, 2 media types, and 1 offsite location, and include an isolated copy (air gap) in the design if needed.
Why might a restore fail even though the backup succeeded?
The main causes are a damaged catalog or encryption keys, infected restore points, and unpracticed procedures. Recovery can take long, as the cited 25-day average downtime in the first half of 2022 shows, so set validation frequencies such as a monthly sample restore and a quarterly catalog restore.
How long should the WORM retention period be?
There is no single answer; the safe basis is the longer of your breach detection time and your regulatory retention requirements. Immutable capacity cannot be reclaimed during retention, so calculate required capacity first as daily change × retention days.
Do these principles apply to backup products other than NetBackup?
Yes. The principles of 3-2-1-1, immutable retention, network isolation, and privilege separation apply regardless of product. However, WORM support and isolation methods differ by product and version, so confirm them in the relevant vendor documentation.
In short, the test of ransomware readiness is not whether you have backups, but whether you can still restore from them after an attack. Design immutable copies, isolated copies, privilege separation, and recovery drills so that each covers the others' gaps.
As of 2026-10-30 · Sources: NetBackup and NetBackup Appliances Hardening Guide (last updated 2026-01-14), Veritas Isolated Recovery Environment white paper, Designing a Data Protection Solution for Rapid Recovery From a Cyber Attack (2023-10-17)
This article is general information based on publicly available vendor documentation and does not recommend purchasing or deploying any specific product. Features and support scope vary by NetBackup version, appliance model, and license, and author suggestions such as role separation, retention periods, and recovery frequencies are examples. Proceed with actual deployment and incident response only after confirming with official vendor documentation and your engineer.