Push backups hand ransomware the keys to your safety net. Pull, and most of you don't.

Push backups hand ransomware the keys to your safety net. Pull, and most of you don't.

When the production server pushes to the backup target, a compromised production box already holds the credentials to reach in and wipe every backup. That's how attackers nuke both at once.

A pull model lets an isolated backup host reach in and grab data, holding the keys production never sees.

— Push: source can delete its own backups
— Pull: backup host is unreachable from the victim

If your web server can delete its backups, ransomware can too. Fight me in the comments.