Ransomware is one of the biggest threats any business faces, and attackers have learned to go after backups first. Many now steal data before they encrypt anything, then delete or scramble every backup they can reach. If your backups can be changed or deleted, an attacker with the right access can wipe out your safety net before you even know they’re there.

The fix is immutable storage. With Backblaze B2’s Object Lock, backups can’t be modified or deleted for a set period. Set up correctly, that includes admins and anyone who steals an admin’s password.

But immutability isn’t something you switch on once and forget. It works best as part of an everyday routine. Here’s how to set it up and keep it working.

Understand What Immutability Does (and Doesn’t Do)

Object Lock stops anyone from changing or deleting a file until its retention period ends. Ransomware can’t encrypt or wipe those cloud copies, because the storage itself refuses the request. For a deeper look at why this matters, see our guide on why immutable backups are non-negotiable.

B2 offers two lock modes, and the difference matters:

  • Governance mode: Protects against accidental or casual deletion. Someone holding a key with special bypass permission can still remove or shorten the lock.
  • Compliance mode: Nobody can delete the file or shorten its lock before the retention date, not even the account owner. You can only extend it.

For ransomware protection, compliance mode is the stronger choice for your key recovery points. Governance mode is handy while you’re testing settings.

Know the limits too. Immutability protects your ability to recover. It doesn’t stop an attacker from copying your data and threatening to leak it. That’s why encryption and endpoint protection still matter (more on that below).

Set Up Backblaze B2 the Right Way

Backblaze B2 is affordable, S3-compatible cloud storage. S3 compatibility means it works with most modern backup software out of the box.

Getting Object Lock right comes down to a few decisions:

  1. Enable Object Lock on the bucket. You can do this when you create a bucket or turn it on for an existing one, in the web console or through the API. It’s a one-way switch, so it can’t be turned off later.
  2. Set a default retention period. Every new file uploaded to the bucket gets locked automatically. Note that the default only applies to new uploads. Files already in the bucket need retention applied separately, or a fresh backup.
  3. Use a dedicated application key. Give your backup software its own key, limited to just its backup bucket. Never use your master account key for day-to-day backups.
  4. Lock down the account itself. Turn on multi-factor authentication for your Backblaze login, so a stolen password alone can’t get anyone into your console.

Follow the 3-2-1 Backup Rule (Plus One)

The classic rule is three copies of your data, on two different types of media, with one copy offsite. The modern version adds one more: at least one of those copies should be immutable. A locked B2 bucket covers both the offsite and the immutable copy in one go.

Pick software that understands Object Lock. Tools like Veeam and MSP360 support B2 Object Lock natively. They set retention on each backup and know not to delete locked files when they clean up old versions. Simple sync tools such as rclone can upload to a locked bucket too, and the bucket’s default retention will lock each file. But they aren’t built around retention rules, so they suit simple file copies better than full backup chains.

Also, encrypt your backups before they leave your network. Most backup tools offer this. If an attacker ever gets read access to your bucket, they’ll only find scrambled data.

Layer It with Endpoint Protection

Backups are your recovery plan. Endpoint protection is your prevention plan, and you need both.

Bitdefender detects ransomware behavior in real time and can restore files it was encrypting, stopping attacks at the source. Its business platform, GravityZone, adds features like PHASR, which restricts the admin tools attackers love to abuse. We cover how the two fit together in our post on Bitdefender PHASR and Backblaze B2.

Together they give you prevention plus recovery. If something slips past Bitdefender, your locked backups are still there.

Make Backup Checks an Everyday Habit

A backup you’ve never restored is a guess, not a plan. Build these checks into your routine:

  • Daily: Confirm last night’s backup jobs finished. Most tools email a report, so a quick glance is enough.
  • Weekly: Look over any warnings or skipped files, and check that new systems or folders are included.
  • Monthly: Restore a handful of real files from B2 and open them.
  • Quarterly: Run a full test restore of an important system, and time it. Review who has Backblaze access and which application keys exist.
  • Yearly: Walk through a ransomware drill from start to finish, then review your retention periods.

Choosing a Retention Period

Most businesses land between 30 and 90 days. Attackers can sit inside a network for weeks before striking, so your lock period should be longer than an intrusion could reasonably go unnoticed. Too short, and every clean copy may have expired by the time you find the attack.

Longer retention costs more, though. Locked files are billed until their lock expires, and you can’t delete them early to save money. Start with 30 days for daily backups, and keep monthly snapshots for longer if your industry requires it.

A Bonus for Compliance

Immutable, timestamped backups make audits easier. You can show regulators and auditors that records haven’t been changed since they were written. Industries with strict record-keeping rules, like finance and healthcare, often look for exactly this kind of storage. Check with your compliance adviser that your setup meets the specific rules you’re under.

Privacy laws pull the other way, though. Under GDPR, for example, people can ask you to delete their personal data, and a compliance-mode lock means you can’t delete it until the lock expires. Set retention periods no longer than you genuinely need, and document why you chose them.

Stay Ready, Every Day

Ransomware isn’t going away, but losing your data to it doesn’t have to happen. Locked backups, strong endpoint protection, and a simple checking routine mean that a bad day stays a bad day, not a business-ending one. With recoverable backups, paying a ransom to get your systems back stops being your only option.

As a reseller and managed service provider for both Backblaze B2 and Bitdefender, we can set this up for you and keep an eye on it. Contact us to talk through your backup setup.