Architecture Principle: Immutability without authority separation is not resilience. A backup is only valid if its restore path survives an Active Directory compromise.
This repository consolidates Rack2Cloud research on immutable backup architecture into a structured reference for architects and infrastructure teams responsible for data protection design.
Immutable backup has evolved from a storage configuration feature into an architectural discipline. The failure mode is no longer "backup doesn't exist" — it is "backup exists but recovery fails." This repository addresses both layers: the storage and platform architecture required for immutability, and the recovery design required for recoverability.
The intended audience is infrastructure engineers, platform architects, and SREs responsible for backup architecture, ransomware recovery planning, and disaster recovery design.
Most backup systems rely on production identity systems (e.g., Active Directory, Entra ID) for restore authorization. This creates a fatal circular dependency during compromise events.
If your primary Identity Provider (IdP) is compromised, attackers will move laterally to your backup control plane to maliciously delete policies, poison replication, or bypass immutable flags using stolen privileged accounts.
Components:
- Production Domain (Compromised Zone)
- Backup Storage Plane (Zero-Trust Data Plane)
- Independent Recovery Authority (Isolated Control Plane)
- Offline Credential Chain (Break-Glass Access)
| Threat | Mitigation Strategy |
|---|---|
| Ransomware / Wiper | Hardware-level immutability (WORM) that cannot be bypassed via the hypervisor. |
| Privilege Escalation | Independent restore auth (Local vault accounts with physical MFA, decoupled from AD). |
| Policy Deletion | Out-of-band metadata and vault locking to prevent retention policy drift. |
| Replication Poisoning | Authority isolation and logically air-gapped pull-only firewall rules. |
To guarantee recovery, the architecture must separate the data plane from the management plane:
- Separate Identity Plane: Backup administration accounts must reside in a dedicated, isolated domain or utilize local physical tokens (YubiKey).
- Immutable Retention Enforcement: Object-level retention policies must prevent deletion during defined windows, regardless of administrative intent.
- Offline Recovery Path: The ability to recover must not depend on the availability of production DNS, DHCP, or IdP services.
The foundational principles governing immutable backup and recoverability design.
Immutability Is Necessary but Not Sufficient
- Immutability Is Not a Strategy: Engineering Recovery Silos for Ransomware Survival — The distinction between having immutable storage and having a recoverable architecture.
- Immutable Backup: Why Object Lock Isn't Enough — Object lock as a starting point, not a complete architecture.
- 3-2-1-1-0 Backup Rule: Modernizing Protocols for 2026 Cyber-Resilience — Updated backup rule for adversarial environments.
Recoverability as an Architectural Property
- Your Ransomware Recovery Plan Has a Recoverability Gap — The gap between backup completeness and recovery success. (Added 2026-06-30)
- Ransomware Recovery Time Is an Architecture Problem — Not a Backup Problem — Recovery time failure traced to architecture decisions, not backup failure. (Added 2026-06-30)
- Cross-Region Replication Is Not Resilience — Why replication is not a substitute for recovery architecture.
- Your Backup System Is Part of the Blast Radius — The backup system itself as an attack surface that must be designed out of the blast radius. (Added 2026-06-30)
Restore is the most common failure point in backup architecture. This section addresses restore as a design discipline.
Restore Architecture
- Backups Fail at Restore Time Because Restore Is Underdesigned — Why restore design is systematically neglected and what that produces under pressure. (Added 2026-06-30)
- The Restore Path Is the Most Neglected Part of Backup Design — Restore path as a first-class design requirement. (Added 2026-06-30)
- The Backup Rehydration Bottleneck: Why Your Deduplication Engine Is Killing Your RTO — Deduplication as a restore-time performance constraint.
- Database Backup Fidelity: Why Crash-Consistent Is Not a Database Backup — Application-consistent backup as a restore fidelity requirement.
RTO and Recovery Metrics
- RTO, RPO, and RTA: Why Recovery Metrics Should Design Your Infrastructure — Recovery metrics as infrastructure design inputs.
- RTO Reality: Why Your Backups Mean Nothing Without a Recovery Drill — Recovery drills as RTO validation.
Design for an adversary that targets backup systems specifically.
Threat Modeling
- Ransomware-Ready Backup Architecture: The Three-Pillar Engineering Framework — Three-pillar framework for backup architecture under adversarial conditions.
- Designing Backup Systems for an Adversary That Knows Your Playbook — Backup architecture assuming adversary knowledge of recovery procedures.
- Backups Are Compromised First: Inside Cohesity FortKnox and the Rise of Cyber Vaulting — Why backup systems are the primary ransomware target and how cyber vaulting addresses it.
Isolation Architecture
- The Connected Air Gap: Why Most Backup Isolation Fails — Air gap design failures under real adversarial conditions. (Added 2026-06-30)
- Logic-Gapping Your Data: Engineering Air Gaps in a Zero-Trust World — Logical air gap design for environments where physical air gaps are impractical.
- Immutability Is Not a Strategy: Engineering Recovery Silos for Ransomware Survival — Recovery silo architecture for ransomware survivability.
Recovery authority is the governance layer that determines who can initiate recovery, under what conditions, and with what verification. Most recovery plans omit it.
- Disaster Recovery Authority: The Missing Layer in Most Recovery Plans — Recovery authority as a structural gap in DR design. (Added 2026-06-30)
- Why Most Disaster Recovery Tests Don't Test Recovery — DR tests that validate process but not recovery — why they pass and what they miss. (Added 2026-06-30)
- Your DR Test Passed. The Assumptions Didn't. — Assumption failures as the primary DR test failure mode. (Added 2026-06-30)
- Recovery Ends the Outage. It Doesn't End the Incident. — Post-recovery incident management as a distinct operational discipline. (Added 2026-06-30)
- Incident Recovery Process: Why the Incident Isn't Over After Restore — Incident lifecycle after restore completion. (Added 2026-06-30)
Evaluate and design immutable backup platforms for enterprise environments.
Platform Comparison
- The Indestructible Vault: How Veeam, Rubrik, and Cohesity Architect Immutable Backups — Platform architecture comparison across the three primary enterprise platforms.
- Rubrik vs Cohesity: Which Architecture Holds Under Ransomware Pressure? — Platform comparison under adversarial conditions. (Added 2026-06-30)
- Rubrik vs Cohesity: Which Backup Architecture Actually Scales? — Platform comparison at scale.
- Rubrik vs Cohesity: The Enterprise Decision Framework — Structured decision framework for platform selection. (Added 2026-06-30)
- Veeam vs Commvault: How Enterprise Backup Platforms Fail Differently — Failure mode analysis across Veeam and Commvault architectures.
- Rubrik vs Veeam — Appliance Immutability vs Infrastructure Control — Architectural tradeoff between appliance immutability and infrastructure-controlled immutability.
Cost Architecture
- The Veeam API Tax: Why Your Immutable Backup Storage Cost Is Never What It Looks Like — Hidden cost drivers in immutable backup storage.
- Your Backup Costs Aren't What You Think: Calculating the True Cost Beyond Storage — Total cost of backup architecture beyond storage.
Control Plane Architecture
- Velero Going CNCF Isn't About Backup. It's About Control. — Kubernetes backup control plane as an architectural consideration. (Added 2026-06-30)
- AI-Driven Data Resilience: Veeam + Securiti AI vs. Rubrik + Bedrock — AI-augmented data protection platform architectures.
Data protection requirements in sovereign, compliance-constrained, and regulated environments.
- Most Sovereignty Strategies Fail Before Architecture Begins — Sovereignty as a pre-architectural failure mode in backup design.
- Sovereign Cloud vs. Public Cloud: Navigating Compliance in a Non-Deterministic Landscape — Compliance architecture for sovereign cloud environments.
- Immutability Is Not a Strategy: Engineering Recovery Silos for Ransomware Survival — Recovery silo architecture in sovereignty-constrained environments.
Disaster recovery as a system designed around recovery, not backup.
- Building a Practical Disaster Recovery Plan for Your First Cloud Project — Foundational DR architecture for cloud environments.
- Nutanix Async & NearSync vs VMware SRM: The Blueprint for Modern DR — DR architecture comparison across Nutanix and VMware SRM.
- The Configuration Drift Discovery During a Drill — Configuration drift as a DR drill failure mode.
- Why Your DNS Failover Didn't Actually Fail Over — DNS failover as a frequently untested DR dependency.
- Your Ransomware Plan Is Fiction: 5 Recovery Metrics Nutanix, Cohesity, Rubrik & Pure Can't Hide — Recovery metric evaluation across major platforms.
Operational tools for evaluating backup architecture and recovery readiness:
| Tool | Purpose |
|---|---|
| Recovery Readiness Assessment | Structured audit for pre-recovery planning and gap identification |
| Recovery Readiness Analyzer | Operational readiness measurement tool |
| Recovery Dependency Mapper | Dependency mapping before a recovery event |
| Disaster Recovery Authority Analyzer | Recovery authority gap analysis |
| Veeam – Immutable Storage Cost Estimator | Immutable storage cost modeling |
| Universal Cloud Restore Calculator | Restore cost and time estimation across cloud environments |
| Engineering Workbench: Disaster Recovery Readiness | Structured starting point for DR readiness programs |
The Data Protection & Resiliency Path provides the structured learning context for this repository's content.
Relevant modules:
- Recovery Readiness Assessment — Structured pre-recovery assessment.
- Architecture Audit Services — Full audit service catalog.
- Vendor feature comparison
- Storage benchmarking
This is a control-plane architecture model focused strictly on authority separation.
This repository is maintained against the Rack2Cloud Canonical Architecture Specifications governance system.
If this framework helped secure your recovery paths, please star the repository.
Architectural frameworks maintained by Rack2Cloud