Verification, isolation, permission, and recovery controls.
Overview
Ransomware and other threats frequently target backup repositories. DATASTOR Shield™ supports isolation, customer-controlled encryption, multi-level verification, self-healing, flexible retention, and least-privilege credential design. The following checks confirm that recovery copies remain available and uncorrupted.
Common Attack Paths
- Phished or over-privileged credentials.
- Backup agents or scheduled tasks running with domain admin or unrestricted production rights.
- Reused local administrator passwords or shared accounts that can reach both production and backup storage.
- Credentials stored in scripts or mapped drives.
Required Checks
1. Restore Testing
DATASTOR Shield™ supports point-in-time recovery, drag-and-drop file restore, and full-system / bare-metal recovery. A local copy allows testing at LAN speed. Daily checkup reports identify jobs that did not run as expected.
Cadence: critical files and applications monthly or quarterly; full systems at least annually and after major changes.
2. Storage Isolation and Permission Lockdown
Place backup repositories on dedicated targets (disk, NAS/DAS, tape, or cloud) separate from general-purpose production shares.
- Dedicated service account used only for protection plans and store tasks.
- NTFS lockdown: only the dedicated account has write access. Limit or remove write permission for other accounts, including Administrators.
- No interactive logon with the backup service account.
- Optional: BitLocker on backup volumes and air-gapping via cartridge rotation.
3. Customer-Controlled Encryption
AES-256 encryption is applied before transmission to the cloud. The customer retains the keys. A secondary protection layer secures the key. This avoids dependence on a third-party cloud provider for key management.
4. Retention Coverage
Configure retention longer than expected ransomware dwell time. Off-site copies can retain longer history while local copies use shorter operational retention.
5. Verification and Self-Healing
Three levels of continuous verification examine referential and data integrity. Failed objects are quarantined and queued for self-healing. Combined with daily checkup reports, this surfaces integrity or job-failure issues before an incident.
Recovery Considerations
Local copies restore at LAN speed. Cloud-only restores are constrained by available bandwidth. Document measured RTO and RPO from actual restore tests rather than theoretical values.
Checklist
- Storage isolated from production shares
- Dedicated least-privilege service account
- NTFS permission lockdown applied
- Customer-controlled AES-256 encryption enabled
- Retention exceeds expected dwell time
- Daily checkup reports reviewed
- Verification and self-healing active
- Scheduled restore tests completed
- Credentials scoped and not used for interactive logon