How Do You Make Your Backups Ransomware-Resistant?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What actually makes a backup ransomware-resistant?

Immutability and separation, in that order. A backup that sits on the same network, under the same administrator credentials and inside the same ransomware-visible file share is not a backup, it is a second copy of the problem. Ransomware operators routinely enumerate network shares and volume snapshots, and the 2026 groups operating out of APAC, where India is the second most ransomware-hit country, have been seen deleting snapshots during encryption to force payment. A genuinely resistant design keeps one copy on immutable or write-once storage, one copy on a separate media type such as tape or removable media, and one copy offline in a different physical location. The three are not redundant: the immutable copy survives a credential compromise, and the offline copy survives a compromise of the backup platform itself.

How long should backups be retained, and what does the law require?

Retention has two masters: operational and legal. Operationally you need enough history to survive the discovery delay, and ransomware dwell time before encryption is often measured in weeks, so a 30-day window is thin. Legally, CERT-In directions require 180 days of log retention, and that is a floor for anything you will need to reconstruct an incident. For a business that wants to demonstrate the chain of custody after a data breach, retain 12 months of immutable backups. One common Indian pattern worth copying is tiered retention: daily for 30 days, weekly for 12 weeks, monthly for 12 months, on immutable storage with a separate credential set.

What belongs in a restore drill, and how often?

One full restore of a production workload, at least quarterly, measured in hours rather than rehearsed in a slide deck. A drill should cover a file-level restore, a database point-in-time restore, a bare-metal or virtual machine rebuild from the newest clean image, and a full identity rebuild because the Active Directory or identity provider is itself backed up and frequently restores badly. Record the time to first restored service and the time to full recovery, then compare it against the recovery targets in your incident response plan. India's 21,900 digital-arrest complaints involving over Rs 647 crore in the first eight months of 2026 show how fast a financial-fraud pattern becomes a multi-agency coordination problem, and recovery speed is what determines whether a compromise stays an IT incident or becomes a reportable event.

How much should a small business spend on backup?

Enough that a single ransomware event does not end the business, which for a Kerala SME typically means a managed offsite backup subscription rather than a capital project. At AAVETech the work starts with a backup and recovery readiness assessment: we review what is copied, where it lives, who can delete it, how quickly it can be restored, and what it would cost to recover. It is a fixed-price engagement at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, delivered in 5 to 10 working days with the retest included, and it produces a written restore procedure your team can actually follow at 2 a.m.

What are the common questions about B?