A backup that nobody can delete — not an attacker, not an admin, not us

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

ImmutableVault locks every RecoveryVault restore point with S3 Object Lock in compliance mode at the moment it is written. Until retention ends, no administrator, stolen key or TotalHeal itself can change or delete it — and every attempt raises an alert.

2The challenge

An attacker with administrator access deletes the backups before encrypting the servers. If any account — yours, a stolen one, or your vendor’s — can delete a backup, the backup is not your last line.

The TotalHeal approach. ImmutableVault writes every RecoveryVault restore point to a repository with S3 Object Lock in compliance mode. Until its retention ends, no administrator, stolen key or TotalHeal itself can change or delete it.

3Architecture

4How it works

1. WriteEach object is locked in compliance mode as it is written.
2. ExtendReused blocks get their lock extended to the new point.
3. RefuseDeletion before retention and lock shortening are refused and alerted.

5Capabilities in detail

• Locked at write timeEvery object of a restore point is locked in compliance mode as it is written.
• Reused blocks stay lockedWhen a new restore point reuses an older block, that block’s lock is extended to the new point’s retention.
• Deletion refusedRetention and clean-up never delete a locked object; deleting a server with held or locked points is refused and raises an alert.
• Lock shortening refusedAttempts to shorten a policy’s lock are refused and alerted as inhibit-recovery activity (MITRE ATT&CK T1490).
• Your bucket or oursOn an S3 bucket created with Object Lock — yours, or TotalHeal’s where offered.

6Security and data handling

• Compliance-mode locksNobody can delete a locked object early.
• Alerts on attemptsShortening or deletion attempts raise alerts.
• Your bucketLocks live in storage you can own.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• TotalHeal RecoveryVault
• An S3-compatible bucket with Object Lock enabled

Start a 30 days trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.