Why should server recovery copies be offsite or immutable?
Offsite storage can reduce exposure to loss of the original location; immutability can restrict alteration or deletion for a defined period. They address different failure scenarios and require appropriate access controls. A remote copy accessible with the same compromised administrator credentials may still be at risk.
Before you start
- Your existing recovery design, threat assumptions and recovery-time requirements.
Instructions
1. Check independence
Identify whether the recovery copy shares the original host, storage, account, credentials or location. Decide which common failures it must survive. Separate authorisation for changing retention or deleting recovery data from ordinary application administration where the chosen platform supports that control.
2. Review the retention mechanism
Confirm exactly what the platform locks and which roles can bypass or change it. Object-storage retention can apply to specific object versions; an apparently deleted current view may differ from the retained versions underneath. Provider documentation and the selected configuration determine the behaviour, not the word immutable alone.
3. Test recovery under the assumed failure
Check access from a trusted environment without the original server, including keys, software and account recovery. Measure retrieval time and any transfer charges. Ensure the retained period covers the incident-detection and recovery window, and assign an owner to review access and retention settings.
Check the result
- The recovery path survives the selected host, account or location-loss scenario.
- A tested restore uses the protected data and independently available credentials.
Troubleshooting
- The copy is offsite but an attacker could delete it
- Review shared credentials and deletion privileges. Geographic separation alone does not provide protection from an authorised account being compromised.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.