Exercise 2: Why the Immutable Backup Survived a Compromised Admin Account — Possible Solution ==================================================================== WHAT COMPROMISED ADMIN CREDENTIALS NORMALLY ALLOW ------------------------------ An admin account with backup-deletion rights can, under normal circumstances, delete or modify any backup it has permission to touch - that's precisely what "having deletion rights" means. Per this chapter, this is exactly what the attacker exploited against the rest of the organization's backups: compromising admin credentials handed them the same deletion capability the legitimate admin would have had. WHAT MAKES AN IMMUTABLE BACKUP DIFFERENT ------------------------------ Per this chapter, "an immutable backup can't be modified or deleted by anyone - including an account with otherwise-full administrative rights - until a defined retention period actually expires." The protection isn't implemented as a permission that could be granted to or withheld from a particular account - it's a property of the backup itself, enforced independently of who is asking or what credentials they're presenting. WHY THIS IS A FUNDAMENTALLY DIFFERENT KIND OF PROTECTION THAN ACCESS CONTROL ------------------------------ Ordinary access control answers "does this account have permission to do this?" - and a compromised account, by definition, has whatever permissions the real account holder had. Immutability doesn't ask that question at all; it enforces "this action cannot happen before this date," full stop, regardless of whose credentials are making the request. That's why compromising the admin account - which defeated every other backup's own access control - had no effect on the immutable copy at all. WHY THIS IS THE DIRECT PAYOFF OF CHAPTER 3's OWN RANSOMWARE WARNING ------------------------------ Chapter 3 warned that ransomware specifically seeks out and destroys accessible backups. This worked example shows exactly that behavior succeeding against every backup within the attacker's reach - and exactly why the one backup outside that reach, protected by a mechanism stronger than credentials, survived to make recovery possible. WHY THIS WORKS AS AN ANSWER ------------------------------ It explains what compromised admin credentials would normally allow, explains that immutability is enforced independently of credentials rather than through them, and explains why that distinction is precisely what let the one immutable copy survive an attack that destroyed every other backup.