Glossary · Recovery Security
Recovery data should be impossible to change
Immutability is the principle that protected data cannot be altered, modified, encrypted, or deleted after it has been written. In backup and disaster recovery, it preserves trusted recovery points even when production systems, credentials, or infrastructure are compromised.
A backup is only useful if you can still trust it when recovery begins.
01 The Definition
What is an immutable backup?
An immutable backup is a protected copy of data that cannot be changed or deleted for a defined period of time. Once it is written, it stays exactly as it is. Depending on the architecture, immutability may prevent:
- Modification
- Deletion
- Encryption
- Overwriting
- Retention changes
- Administrative alteration
The result is a trusted recovery point that remains available even if production systems are compromised.
02 The Reason
Why immutability matters
Modern cyberattacks do not stop at production. Attackers increasingly target the infrastructure organizations depend on for recovery. They may attempt to:
- Delete backup repositories
- Encrypt backup storage
- Corrupt backup catalogs
- Modify retention policies
- Compromise backup administrators
- Disable recovery systems
The goal is simple. Remove the victim's path back to operations.
If backups can be changed or deleted, recovery becomes uncertain.
03 Side By Side
Standard backup vs immutable backup
Not every backup is immutable.
| Standard Backup | Immutable Backup |
|---|---|
| May be modified or deleted | Cannot be modified or deleted during retention |
| Retention may be changed | Retention protection is enforced |
| Depends primarily on permissions | Protected through enforced storage controls |
| Vulnerable to compromised credentials | Designed to resist unauthorized alteration |
| May remain writable | Write-once protection is enforced |
A standard backup creates another copy. An immutable backup protects that copy from change.
04 The Mechanics
How immutability works
Immutable storage relies on write-once policies, time-based retention locks, administrative override restrictions, snapshot protection, and storage-level enforcement. Once the recovery point is written:
The recovery point stays consistent with the moment it was created.
05 The Window
Immutability is enforced for a defined period
During that window, the protected data stays locked from alteration or deletion. The length of the window is a design decision, not a default.
01 Typical windows
- 24 hours
- 7 days
- 30 days
- 90 days
- A longer compliance-defined period
02 Design retention around
- Recovery requirements
- Ransomware risk
- Regulatory obligations
- Cyber insurance expectations
- Storage capacity
- Business continuity needs
Keep trusted recovery points available long enough to survive the events you are preparing for.
06 The Threat
Immutability and ransomware
Ransomware targets backups because clean recovery points reduce the attacker's leverage. A campaign may encrypt production data, delete shadow copies, destroy backups, compromise administrative accounts, and disable recovery systems.
Immutable backups counter this by preserving recovery points that cannot be modified after they are written. Even if ransomware reaches production, a protected immutable recovery point remains available.
The organization still has a path back.
07 The Insider Risk
Why administrative access matters
In traditional backup environments, powerful credentials are a single point of failure. An attacker holding them may be able to delete backups, reduce retention periods, disable backup jobs, modify recovery points, and erase recovery catalogs.
True immutability should not depend on trusting the administrator. The protection has to be enforced by the recovery architecture itself.
The difference between “you are not allowed to change this” and “this cannot be changed.”
08 Two Controls
Immutability vs air gap
Related, but they solve different problems. The strongest recovery architectures use both.
Air gap
Separates recovery storage from production systems, reducing the ability of attackers or malware to reach the backup environment. A logical air gap does this through architecture rather than physical disconnection:
- Recovery storage not mounted to production
- No persistent write access from production
- Segmented administrative interfaces
- Controlled replication channels
- No writable network shares
Air gap reduces access.
Immutability
Prevents protected recovery points from being changed after they are written, reducing the ability of attackers to alter or delete stored backup data.
Even if access is somehow obtained, the recovery point still cannot be changed during the enforced retention window.
Immutability prevents alteration.
Isolation protects access. Immutability protects the data itself.
09 Two Implementations
Logical vs physical immutability
Immutable protection can be enforced in software or in hardware. Both share the same fundamental goal.
01 Logical immutability
Software-enforced policies prevent changes during a defined retention window.
- Write-once policies
- Retention locks
- Restricted administrative overrides
- Protected snapshots
02 Physical immutability
Hardware-level controls enforce write-once-read-many behavior, commonly referred to as WORM.
Once the recovery point is created, prevent it from being changed.
10 Scope
What immutability does, and does not do
Immutability is critical. It is not a complete recovery strategy by itself.
Protects against
- Ransomware targeting backup infrastructure
- Accidental deletion
- Malicious insiders
- Administrative compromise
- Unauthorized modification
- Retention manipulation
- Production-side encryption attacks
The value is not that another copy exists. It is that the copy remains trustworthy.
Does not do
- Prevent ransomware infection
- Stop attackers entering the network
- Eliminate downtime
- Guarantee every snapshot is clean
- Replace recovery testing
- Replace Disaster Recovery
- Automatically provide Instant Recovery
It preserves recovery points. The architecture determines how fast they become operational.
11 The Blind Spot
A backup can be immutable and still recover slowly
Immutability protects the integrity of the recovery point. It does not determine recovery speed. A platform may have perfectly immutable backups and still require:
- Full data restoration
- Server rebuilding
- Application reconfiguration
- Dependency recovery
- Hours or days of data movement
The backup is safe. The business is still offline.
True resilience needs trusted recovery points and a fast path back to operations.
12 The Pairing
Immutability and Instant Recovery
Quorum combines immutable snapshots with snapshot-based activation. Instead of requiring the full recovery point to be restored before systems can run:
Immutability preserves the recovery point. Instant Recovery puts it to work.
Boot first. Restore whenever.
13 Unaltered Is Not Clean
Immutability and Clean Room Recovery
A recovery point can be unaltered and still contain a threat that existed before the snapshot was created. This matters most with ransomware that stays dormant before encryption begins.
Clean Room Recovery allows protected systems to be activated and inspected in isolation before returning to production.
Immutability preserves the evidence. Clean Room validation determines whether it can be trusted.
14 Everywhere It Lives
Immutability across the recovery architecture
A protected copy should be protected wherever it sits. The location changes. The need for trustworthy recovery points does not.
High Availability
Local recovery points restore operations after localized failure. If a server, application, or host fails, select a protected snapshot, activate locally, boot, and resume. The recovery point stays trustworthy.
Disaster Recovery
Snapshots replicate to a secondary location while maintaining recovery integrity, protecting against site failure, infrastructure loss, regional events, and ransomware requiring site isolation. A remote copy should not just exist. It should remain protected from alteration.
Quorum Cloud
Immutable snapshots combined with encryption in transit and at rest, logical separation from production, tenant isolation, individual firewall isolation per customer, and zero-trust authentication.
15 The Paperwork
Compliance and cyber insurance
Immutability is increasingly something organizations have to demonstrate, not just implement.
Compliance
Immutable backup may support organizations facing:
- Regulatory data-retention requirements
- Legal hold obligations
- Financial record retention
- Healthcare data protection requirements
- PCI-related environments
Retention windows should align to actual legal, regulatory, insurance, and operational requirements.
Cyber insurance
Insurers evaluate recovery architecture, not just prevention. Expect to be asked:
- Are backups immutable?
- Are backups air-gapped or logically isolated?
- Is MFA enforced?
- Are recovery procedures documented?
- How often is recovery tested?
- Can you recover without paying ransom?
Insurers may also expect evidence that recovery points are tested and actually recoverable.
16 The Platform
How Quorum uses immutability
onQ maintains immutable recovery snapshots as part of a broader security architecture. Protected snapshots are immutable once written, encrypted, separated from persistent production write access, stored within an isolated recovery architecture, and available for local, remote, or cloud recovery workflows.
- Immutable snapshots
- Logical air gap separation
- Encryption in transit and at rest
- Zero-trust authentication
- Role-based access control
- Secure replication
- Automated recovery testing
- Clean Room validation
- Local, remote, and cloud activation
No single control solves every risk. Together, they protect the recovery path.
When immutable backup is essential
Immutability should be a priority when:
- Ransomware risk is significant
- Backup infrastructure is network-connected
- Administrative credential compromise is possible
- Regulatory retention requirements apply
- Cyber insurance requires stronger recovery controls
- Critical systems cannot afford permanent data loss
- Business continuity depends on trusted recovery points
The higher the cost of losing the backup, the more important immutability becomes.
17 Assumptions Worth Testing
Common immutability misconceptions
“Immutable means the backup is clean.”
Immutability means the recovery point cannot be altered after it is written. If malware was already present before the snapshot was created, it may still exist within the recovery point. Validation is still essential.
“Immutable backup prevents ransomware.”
It does not stop ransomware from infecting production. It prevents ransomware from changing protected recovery points. Prevention and recovery solve different problems.
“If a backup is immutable, we do not need Disaster Recovery.”
Immutability protects the integrity of the recovery point. Disaster Recovery provides a second location and an operational recovery path when the primary site is unavailable. They address different risks.
“Air gap and immutability are the same thing.”
An air gap reduces access. Immutability prevents alteration. They are strongest when used together.
18 Put It Into Practice
Immutability checklist
A backup is only valuable if it remains trustworthy when it is needed.
- Can protected recovery points be modified after creation?
- Can an administrator delete them during retention?
- Can retention be shortened after the snapshot is written?
- Can production systems write directly to backup storage?
- Are recovery points isolated from production?
- Is there a logical air gap?
- Are snapshots encrypted?
- Can recovery points be tested safely?
- Is Clean Room validation available?
- Can systems activate without a full restore?
- Are secondary recovery copies protected too?
- Has ransomware recovery actually been tested?
Immutability Protects The Path Back.
When production is compromised, the backup cannot become the next victim.
Immutability does not replace prevention, testing, or Disaster Recovery. But without trustworthy recovery points, none of those strategies have a reliable foundation. Quorum combines immutable snapshots with logical isolation, Instant Recovery, remote replication, Clean Room validation, and cloud recovery.
Right onQ. Off Was Never an Option.
Eliminate Downtime from Recovery
Eliminate Downtime from Recovery
Boot systems directly from snapshots and keep operations running without restore delays.