Many ransomware groups now go after backups first, and a stolen admin password is usually all they need. Backup vendors such as Veeam have added features to tackle this. Much of the protection, though, comes from how accounts are set up.
How Attackers Reach the Backups
The route is often simple. A phishing email gives the attacker a foothold, they find a domain admin account, and the backup server accepts it because it sits in the same Windows domain. From there, retention can be cut, restore points deleted and jobs quietly disabled before the main attack. Insiders with full rights pose a similar risk.
Separating and Limiting Access
Keeping backup servers out of the main domain breaks that path. Backup staff then use dedicated accounts with multifactor authentication, used for nothing else.
Roles matter too. Help desk staff restoring files do not need the power to delete a year of backups. Only two or three named people should be able to change retention or remove restore points.
Second Approvals and Locked Copies
Platforms including Veeam can require a second administrator to approve destructive actions, so one stolen account is not enough. Immutable copies go further, since they cannot be changed or deleted by anyone until the lock period ends.
Access Control Checklist
- Backup servers outside the main Windows domain.
- Dedicated backup accounts with multifactor authentication.
- Role based access with very few full administrators.
- Second person approval for deletions and retention changes.
- At least one immutable or offline copy.
- Alerts to a separate system when backups or settings change.
- A sealed emergency account stored offline.
- Quarterly reviews of who holds access, including contractors.
Keeping Controls Current
Settings drift. Temporary accounts get forgotten, and approval rules get switched off during busy projects. A quarterly check against the list above, plus an occasional planned attempt to delete a test backup with a normal admin account, shows whether the protections still hold.