Tutorials · Security
How to Protect Backups From Ransomware With Network Design
Ransomware targets backups first. Isolate backup systems, restrict access paths and keep immutable or offline copies.
Before you start
- An existing backup system
- Managed switches and a firewall
Step by step
Follow 3-2-1-1
Three copies, two media types, one off-site and one immutable or offline.
Isolate the backup network
Place backup servers and storage in their own VLAN. Only the backup server may connect to sources, and only on required ports.
Separate credentials
Use dedicated backup admin accounts not joined to the main domain, with 2FA.
Block management from user networks
No user VLAN should reach backup consoles or storage management interfaces.
Enable immutability
Use storage or cloud services that keep backups unchangeable for a set period.
Keep an offline copy
Rotate drives or tapes that are physically disconnected.
Test restores
Restore critical systems quarterly to prove backups work and to know how long recovery takes.
Monitor
Alert on unusual deletions, failed jobs and changes to retention settings.
Pro tips
- Document the recovery plan and keep a printed copy.
- Practise recovery with the team.
FAQ
Frequently asked questions
Is cloud backup enough?
Cloud is a good off-site copy, but protect it with separate credentials and immutability.
Keep learning
Related guides
Ransomware and critical infrastructure
Read more →Segment IoT and CCTV
Read more →How to Enable 802.1X Port Authentication on Switches
Stop unknown devices from using your network ports: configure 802.1X with RADIUS and MAC-authentication bypass for printers and cameras.
Read more →How to Secure the Management of Switches, Routers and Access Points
A hardening checklist for every network device: strong credentials, SSH only, a management VLAN, access lists and logging.
Read more →How to Segment IoT and CCTV Devices From Your Main Network
Put cameras, smart TVs, sensors and building systems in their own VLANs so one compromised device cannot reach your business systems.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.