How to protect backups from ransomware starts with a hard truth: attackers aren't just encrypting your data anymore, they're stealing it first — and no backup system on earth undoes an exfiltration. In this encore episode of The Backup Wrap-Up, Curtis and Prasanna dig into what real immutability looks like versus the marketing version, why root access quietly undermines most "immutable" storage claims, the difference between virtual and true physical air gaps, and the exact questions you should be firing at your backup vendor before you trust them with your last line of defense.

This one's an encore for a reason — it was one of the most listened-to episodes in the show's history, with listeners sticking around for the full runtime and then some. That's the kind of signal that tells you it's worth a second run.

Along the way, they cover S3 object lock and what actually happens if your account gets deleted or your credit card stops working, why compromised admin credentials are involved in the majority of attacks and what your vendor should be able to undo, and why bit rot — rare, but nasty when it's silent — still belongs on your checklist. If you manage backup or DR for a living, or you're just trying to figure out whether your current setup would actually hold up, this episode gives you a concrete list of questions to ask and red flags to watch for.

Chapters:

00:00 – Cold Open: Ransomware Is After Your Backups

01:19 – Welcome & Banter

05:50 – Topic Setup: Protecting Backups from Ransomware

07:36 – The Extortion & Exfiltration Playbook

15:25 – What Is an Air Gap?

18:22 – Virtual Air Gaps

27:57 – Real (Physical) Air Gaps

28:12 – What Is Immutability, Really?

29:23 – Bit Rot

30:42 – Root Access & the Limits of Immutability

32:51 – S3 Object Lock

40:20 – Questions to Ask Your Backup Vendor

42:31 – What Happens If You Delete Your Account?

44:29 – Compromised Credentials & Worst-Case Scenarios

46:41 – Final Thoughts