How to protect backups from ransomware is not really a question about antivirus software. It is a question about access. Which machines can reach the backup? Which accounts can delete it? Can an infected endpoint overwrite yesterday’s clean copy? How long do older versions survive? And can you restore without reconnecting a compromised system to the data you are trying to save?
Those questions matter because modern ransomware operators do not have to stop at the files on a workstation. Recovery is leverage. If attackers can destroy the backups first, encrypting production data becomes far more damaging.
The right mental model is simple: a backup should be easy for the backup process to write and difficult for everything else to destroy. That usually means more than one recovery path, limited credentials, retained versions, at least one offline or otherwise protected copy, and restore tests performed before an emergency.
The short answer
To protect backups from ransomware, keep multiple independent recovery copies, make sure at least one is offline, disconnected or resistant to destructive changes, separate backup credentials from everyday accounts, preserve enough version history to return to a clean point, restrict network access to backup storage, and test restores regularly.
On a Windows PC, a practical design may combine a versioned local backup for fast recovery, a second copy outside the local attack path, and a removable drive that is disconnected when the job is complete. Windows security features such as Microsoft Defender’s Controlled folder access can reduce the chance that untrusted applications modify protected user folders, but prevention controls are a supplement to independent backup—not a replacement for it.
- Why ransomware attacks the backup first
- Map the paths an attacker can use to reach your copies
- Keep at least one backup offline or isolated
- Separate backup identities and limit destructive privileges
- Protect history: retention matters as much as location
- Harden NAS and cloud backup paths
- Use Windows ransomware defenses as another layer
- Build a ransomware-resilient layout with Perfect Backup
- Plan a clean restore before you need one
- Common backup mistakes ransomware punishes
- Frequently asked questions
1. Why ransomware attacks the backup first
Ransomware is most powerful when recovery looks impossible. That is why a serious attack may try to discover network shares, attached USB storage, backup servers, cloud credentials and administrative tools before or alongside encryption of normal files. The objective is not merely to damage today’s data. It is to remove yesterday’s safe state.
The UK National Cyber Security Centre’s ransomware guidance explicitly warns that attackers target backups and recommends regular, tested backups that are kept offline or otherwise separated from normal systems. Its newer ransomware-resistant backup principles go further: backup systems should be isolatable, resilient to destructive actions and able to restore an earlier version even if later versions become corrupted.
This changes the way a home user or small business should think about “having a backup.” An external drive connected twenty-four hours a day may be excellent protection from an SSD failure. Against ransomware, however, it is still a storage device visible to a compromised computer. A writable NAS share may be convenient for nightly jobs but remains part of the network attack surface. A cloud repository can be physically remote yet still exposed if the compromised machine holds credentials that can delete or overwrite it.
None of those destinations is automatically bad. They simply solve different failure modes. Ransomware protection comes from removing the assumption that one access path can be trusted forever.
2. Map the paths an attacker can use to reach your copies
Before buying another disk, draw a quick map. Start with the Windows PC and list every place a backup lands. Then draw the connection that makes the backup possible.
| Backup location | Normal access path | Ransomware question |
|---|---|---|
| USB hard drive | Directly attached to Windows | Is it still connected after the job finishes? |
| NAS | SMB/network share | Can the everyday Windows account write or delete backup files? |
| Cloud storage | App, browser token or backup credentials | Can a compromised endpoint erase old versions or change retention? |
| Second PC/server | Network credentials | Does it share the same administrator identity? |
| Offline disk | No path when disconnected | How often is it updated, and where is it stored? |
This exercise exposes a common weakness: multiple copies that depend on the same identity. For example, the user account signed into Windows can write to the NAS, manage the synced cloud folder and access an attached USB disk. Physically there are several destinations; logically they all hang from one compromised session.
Think of each connection as a bridge. You need enough bridges to automate backup, but you do not need every bridge to remain open permanently.
3. Keep at least one backup offline or isolated
The most understandable form of ransomware isolation is still the removable disk: run the backup, safely disconnect the drive, and store it somewhere the computer cannot reach. When the cable is out, malware on the PC cannot encrypt the disk through Windows.
That does not mean the only good backup is a manually rotated hard drive. Cloud and managed backup systems can create equivalent separation through immutability, retention locks, append-only behavior, soft delete, isolated credentials or other controls. The NCSC’s cloud backup principles emphasize resistance to deletion and alteration, plus the ability to restore earlier versions even after newer backups are damaged.
A useful pattern for a single Windows computer is a “hot + cold” pair. The hot backup is local and convenient, perhaps a NAS or attached drive that receives frequent jobs. The cold copy is updated less often but is not continuously exposed. If ransomware destroys the hot layer, the cold copy becomes the recovery anchor.
The trade-off is recency. A disk disconnected for a month may survive perfectly but still cost a month of work. Rotate or update offline copies often enough that the remaining data-loss window is acceptable.
4. Separate backup identities and limit destructive privileges
Storage isolation is only half the problem. Credentials are often the real bridge.
If the same administrator account used for everyday work can also delete every backup, an attacker who steals that account inherits the same power. Wherever your storage supports it, use dedicated backup identities, separate administration from routine file access, and avoid granting deletion rights to clients that only need to create new backup data.
For a NAS, that can mean a dedicated account used only by the backup task rather than mapping the backup share with a personal account. For cloud storage, use multi-factor authentication for administrative access and avoid leaving high-privilege credentials on every endpoint. For enterprise or managed systems, separation between the interface that ingests backup data and the interface that manages or deletes backups is even stronger.
The goal is not “zero access.” A backup task obviously needs enough permission to write. The goal is asymmetric access: the routine job can create what it needs, but compromising one Windows session should not automatically grant the ability to destroy the entire history.
5. Protect history: retention matters as much as location
Ransomware recovery is often described as finding the “last clean backup.” The phrase hides an important detail: how far back is last clean?
If malware or account compromise goes unnoticed for several days, every recent backup may contain encrypted files, corrupted documents or unwanted changes. A backup system that keeps only the newest copy can faithfully preserve the bad state and delete the good one.
That is why version history and retention are security controls, not just convenience features. Keep enough restore points to outlast the period in which a problem could remain unnoticed. For some personal data, several weeks may be enough. Business systems may need longer retention, especially when suspicious activity can remain undetected for a significant time.
Retention should also resist rapid churn. Imagine ransomware changes thousands of files, and an automated job immediately creates a series of new backups. If the repository keeps only the latest N backups, the clean points may be pushed out faster than expected. Time-based retention or protected historical versions can reduce that risk.
This is also why a Mirror job has a different role from a versioned backup. A mirror is excellent when you want an up-to-date replica. But if the source is encrypted or files are deleted, an automatic mirror can eventually reproduce that current bad state. For ransomware recovery, historical restore points are usually the more valuable layer.
6. Harden NAS and cloud backup paths
NAS: treat the backup share as infrastructure, not a public folder
A NAS is one of the best backup destinations for a small Windows network because it is always available and can hold far more history than a laptop. Its convenience is also its risk. If every user can browse, modify and delete the backup repository, ransomware running as one of those users may be able to do the same.
Use a dedicated backup share, restrict ordinary browsing, minimize write permissions, patch the NAS, disable services you do not need, and keep administrative access separate from normal Windows credentials. If the device offers snapshots that normal clients cannot delete, they can add another rollback layer—though snapshots on the same NAS should not be the only backup.
Cloud: physical distance does not guarantee logical isolation
Cloud storage solves the location problem elegantly, but the control plane matters. Ask whether old versions can be deleted immediately, whether soft-deleted backups remain recoverable, whether retention settings can be locked, how administrative MFA works and whether a compromised backup client can overwrite history.
Simple file synchronization deserves extra caution. Sync is designed to propagate current state. If ransomware encrypts synchronized files, the encrypted versions may be uploaded as legitimate changes. Version history can help, but a separate backup repository gives you another recovery boundary.
7. Use Windows ransomware defenses as another layer
Backup resilience is about recovery. You should still reduce the chance that ransomware reaches the files in the first place.
Windows includes Controlled folder access in Microsoft Defender Antivirus. Microsoft describes it as a ransomware protection feature that allows trusted applications to modify protected folders while blocking untrusted apps. On current Windows 11 systems it can protect common user folders and can be extended to additional locations.
Controlled folder access is useful, but it does not turn a connected backup drive into an offline backup. It also requires care when allowing applications: Microsoft notes that an allowed application gains access to the protected folders, so exceptions should be deliberate.
Other basic controls still matter: keep Windows and backup software patched, avoid working permanently as an administrator, use strong authentication, and pay attention to unexpected mass file changes. Prevention buys time. Isolation preserves the recovery path if prevention fails.
8. Build a ransomware-resilient layout with Perfect Backup
Perfect Backup can automate the copying and versioning parts of a resilient design, but it cannot make an always-connected, universally writable destination immune to ransomware. The storage layout still matters.
A practical two-job layout
For important documents, a useful design is:
- Job 1: frequent versioned file backup. Use Files and Folders Backup to an external drive or NAS for quick everyday recovery.
- Job 2: a second destination. Duplicate the protection to storage that does not share the same failure and access path.
- Offline rotation. If using removable media, disconnect at least one copy after the backup completes and rotate it on a predictable schedule.
- System recovery. Add Drive Image Backup when you also need a way to recover the full Windows system drive, not just documents.
Files and Folders Backup supports Full, Incremental, Differential and Mirror. Full/Incremental/Differential are the natural choices when you want restore points and history. Mirror is useful for maintaining a current replica, but it should not be mistaken for ransomware history because it does not create restore points.
If you use an external drive, consider the operational habit part of the backup job: connect, run, verify, disconnect. If you use a NAS, protect its share and credentials. If the second destination is cloud or remote storage, make sure the account and retention settings are not controlled by the same everyday Windows identity.
9. Plan a clean restore before you need one
The worst time to design ransomware recovery is after the ransom note appears.
Write down the order of operations. First isolate affected systems. Determine which machines and credentials may be compromised. Decide which backup generation is old enough to be trusted. Rebuild or clean the target environment, then restore data into that clean environment rather than reconnecting a backup directly to a machine you still suspect.
The NCSC’s incident guidance stresses that backups used for recovery should be confirmed clean. That is especially important for system images and folders containing executable content. A backup can be intact and still contain malware that existed before encryption began.
For personal files, testing can be simple: restore a selection of documents and photos to a temporary folder, open them, and verify that the files predate the incident. For a business, recovery testing should include applications, permissions, configuration and the time required to bring essential systems back.
Also test the human side. Do you know the encryption password if your backup uses one? Can you reach the recovery environment without the compromised PC? Is the second-factor device available? Are the instructions stored somewhere other than the computer that just failed?
10. Common backup mistakes ransomware punishes
1. Leaving every USB backup connected
The second disk protects against hardware failure but may share the ransomware attack path. Disconnect at least one recovery copy when practical.
2. Giving normal users full control of the backup share
If routine accounts can delete the repository, stolen routine credentials may be enough to erase recovery points.
3. Calling synchronization a ransomware backup
Sync can reproduce encrypted files just as efficiently as healthy ones. Version history helps, but independent backup is a stronger boundary.
4. Keeping only the newest restore point
A rolling single copy can age out the last clean state before you notice the attack. Preserve history long enough to cover delayed detection.
5. Assuming “cloud” means immutable
Cloud is a location and delivery model. Whether backups resist deletion depends on retention, permissions and service design.
6. Never restoring until the emergency
A green backup log does not prove the data is clean, complete or recoverable at the speed you need.
11. Frequently asked questions
Can ransomware encrypt backup drives?
Yes. If a backup drive is connected and writable from the compromised computer, ransomware may be able to modify or encrypt it just like other storage. Disconnecting or otherwise isolating at least one copy reduces that risk.
Is an external hard drive safe from ransomware?
It is much safer when disconnected after the backup. A permanently attached external drive still shares the Windows attack path and should not be the only recovery copy.
Can ransomware affect a NAS backup?
Yes, if the infected machine or compromised account has sufficient access to the NAS share. Dedicated credentials, restricted permissions, segmentation and protected snapshots can improve resilience.
Are cloud backups safe from ransomware?
They can be highly resilient, especially when the service protects old versions from alteration or deletion. But cloud storage is not automatically immutable; review retention, soft delete, account security and client permissions.
How many backup versions should I keep for ransomware recovery?
There is no universal number. Keep history long enough to cover the time an infection or compromise might remain unnoticed. Time-based retention over several weeks is often more useful than keeping only a small fixed number of recent runs.
Should I restore a system image immediately after a ransomware attack?
Only after you are confident about the recovery point and the target environment. Identify the likely compromise window, isolate or rebuild affected systems, and restore from a known-good image or backup rather than blindly returning the latest state.
Protect the path back, not just the copy
The most useful way to think about ransomware backup protection is not “where is my backup?” but “what authority is required to destroy it?” A copy on another disk is useful. A copy that the compromised Windows session cannot erase is much more useful.
Layer the defenses. Keep fast local restore points. Maintain a second destination. Preserve enough history. Disconnect or isolate at least one recovery copy. Protect backup identities. Test recovery to a clean environment. None of these measures has to be perfect on its own; together they make it much harder for one attack to remove every route back.
That is the difference between a backup system that works during normal weeks and a recovery system designed for the week when everything goes wrong.
References and product documentation
- UK NCSC: Mitigating malware and ransomware attacks
- UK NCSC: Ransomware-resistant backups
- UK NCSC: Principles for ransomware-resistant on-premises backups
- UK NCSC: Principles for ransomware-resistant cloud backups
- CISA: Ransomware Guide
- Microsoft Learn: Controlled folder access
- Perfect Backup User Guide: Files and Folders Backup
- Perfect Backup User Guide: Restoring Files and Folders