Data Protection Against Ransomware: A Layered Approach

Ransomware remains one of the most damaging threats businesses face today. IBM’s 2025 Cost of a Data Breach Report puts the global average cost of a data breach at $4.44 million — and when the incident specifically involves ransomware disclosed by the attacker, that average climbs to $5.08 million. In the United States, the average breach cost hit a record $10.22 million, the highest of any country for the 15th year running. These attacks inflict direct financial damage, disrupt operations for months, and erode customer trust. Safeguarding your data requires robust, layered countermeasures — not a single control you hope holds.

This post covers the core strategies for protecting your backups specifically, since a ransomware attack that can’t reach a clean, recoverable copy of your data loses most of its leverage.

Understanding ransomware attacks

Ransomware is malicious software that encrypts files on a victim’s system, making them inaccessible until a ransom is paid. Modern strains use encryption strong enough that recovery without the decryption key is effectively impossible, and payment is typically demanded in cryptocurrency to preserve the attacker’s anonymity.

Common entry points. Phishing emails remain the most common route in — a user clicks a malicious link or opens an infected attachment. Compromised websites, exploited vulnerabilities in outdated software, and weak or exposed Remote Desktop Protocol (RDP) credentials round out the usual list of entry points.

The impact. Beyond the ransom itself, downtime from encrypted systems halts operations directly, and the reputational damage from a public incident can outlast the technical recovery by months. WannaCry (2017) and the Colonial Pipeline attack (2021) remain the reference points most people recognize — WannaCry affected hundreds of thousands of computers worldwide, and Colonial Pipeline triggered fuel shortages across the US East Coast. More recently, the 2025 attack on Marks & Spencer showed the same pattern playing out at a major retailer: attackers used a phishing attack against a third-party vendor to reset admin credentials, then disrupted e-commerce operations across more than 1,400 stores. The playbook hasn’t changed much in eight years — what’s changed is how much is now riding on getting the response right.

Implementing air-gap backup

Air-gap backup creates a physical or logical separation between primary storage and backup systems, so that even a fully compromised production environment can’t reach — and therefore can’t encrypt or tamper with — the backup copy.

Benefits and limitations. The core advantage is resilience: an air-gapped copy sits outside an attacker’s reach by design. The trade-off is operational complexity — air-gapped backups need careful scheduling to stay current, and restoring from an offline or segmented copy typically takes longer than restoring from an always-on system.

Setting it up:

• Identify which data actually needs air-gap protection, based on its importance to business operations.
• Choose the isolation mechanism — offline media, network-segmented storage, or a purpose-built air-gap integration.
• Build a backup schedule that keeps the air-gapped copy current.
• Lock down access to the backup media or isolation layer with strict controls.
• Test the recovery process regularly — an air-gapped backup you’ve never restored from is a hypothesis, not a plan.

See how Storware implements this: Air-Gap Data Protection with Storware Backup and Recovery. Storware supports three built-in air-gap backends — Rubrik Managed Volumes, Catalogic vStor Server, and IsoLayer — so this isn’t a theoretical capability layered on top of the product; it’s a documented, built-in integration point.

Using immutable backup destinations

Immutable backup destinations enforce write-once-read-many (WORM) policies: once data is written, it can’t be modified, altered, or deleted by unauthorized users or processes — including, critically, by ransomware that’s gained administrative access to the rest of the environment.

Benefits and limitations. Immutability protects data integrity and directly supports regulatory retention requirements. The cost is storage overhead from retained copies, and write/retrieve operations can take somewhat longer given the read-only enforcement.

Recommended practices:

• Choose backup software with genuine immutable-storage support — object storage with retention policies, or a platform with immutability enforced at the filesystem level.
• Define strict access controls for who can manage the backup destination; multi-factor authentication and role-based access control (RBAC) should be the baseline, not an add-on.
• Monitor immutable destinations for anomalies and audit regularly to confirm both data integrity and policy compliance.
• Test restoration from immutable backups on a schedule, not just after an incident.

Leveraging tape backup

Tape remains a reliable, cost-effective backup medium — magnetic cartridges managed through tape drives and robotic libraries, offering high-capacity, offline storage for long-term retention.

Benefits and limitations. Tape provides genuine air-gap protection by default: an offline cartridge simply isn’t reachable by ransomware. It’s also the cheapest option per terabyte for long-term retention and highly portable for secure off-site storage. The trade-offs are slower data retrieval than online storage and the operational overhead of manual handling.

Best practices: rotate cartridges on a schedule and store off-site to protect against local disasters; encrypt tape data and manage keys securely; test restoration through regular recovery drills; and track each cartridge’s lifecycle so ageing or damaged media gets replaced before it fails silently.

See how Storware supports this: Tape Storage and Other Storage Types.

Combining strategies for layered protection

Each of these strategies — air-gap, immutable destinations, tape — provides meaningful protection on its own. Combined, they remove any single point of failure: air-gap and immutability reinforce each other by adding both a physical/logical separation layer and a tamper-proof guarantee, while tape’s inherent offline nature adds a third, independent layer that survives even a total compromise of everything online.

Putting it together:

• Assess data criticality first — not everything needs the same level of air-gap or tape protection, so prioritize by business impact.
• Build one backup plan covering all three strategies, with defined frequencies, retention periods, and clear ownership.
• Test recovery for each strategy individually and in combination — a full system restore, an incremental file-level recovery, and a backup-integrity verification are three different tests, not one.

This is close to what the industry now calls the 3-2-1-1-0 rule: three copies of your data, on two different media types, one copy off-site, one copy immutable or air-gapped, and zero errors on your last recovery test.

Detecting threats before they spread

Proactive monitoring — intrusion detection, behavior-based endpoint protection, and SIEM correlating log data across sources — remains the first line of defense, catching suspicious activity before it reaches your backups at all. We cover how backup platforms specifically contribute to this detection layer, including anomaly detection and pre-restore scanning, in a companion piece: Ransomware Detection Through Backup.

On the backup side specifically, Storware’s documented security stack includes the Isolator air-gap mechanism, immutability enforced at the XFS filesystem level, and multi-factor authentication on the management console itself — closing off the credential-based access path that increasingly bypasses traditional detection tools entirely.

To sum up

Data protection against ransomware isn’t a single product decision — it’s a layered strategy. Air-gap backup, immutable destinations, and tape each close a different gap, and combined they remove the single point of failure that makes any one control, on its own, a risk. Regular testing, active monitoring, and the basics — employee awareness, access controls, patched software — round out the posture. The cost of building that layered defense is consistently lower than the cost of not having it: per IBM’s 2025 figures, that gap now runs into the millions per incident.