Question

A hospital's security architect is redesigning the backup architecture after a tabletop exercise revealed that a ransomware actor with domain admin credentials could encrypt or delete both production data and the existing network-attached backup repository. Regulatory requirements mandate a 4-hour RPO for patient records, and the organization needs assurance that backups cannot be altered or deleted during their retention window, even by a compromised administrator account. Which design BEST meets these resilience requirements?

Accepted Answer

Write backups to immutable (WORM) object storage with a locked retention policy and maintain a logically air-gapped copy, ensuring no single administrator can shorten or bypass the retention lock

Answer

Increase backup frequency to hourly and store copies on the same NAS with role-based access control restricting deletion to a dedicated backup service account

Answer

Replicate backups to a second on-premises NAS in a different building and enable full-disk encryption on both repositories

Answer

Deploy an EDR agent on the backup server and require MFA for all administrative logins to the backup console