Ransomware attacks frequently target backup storage to prevent data recovery. According to Veeam 2025 Ransomware Trends, 89% of organizations hit by ransomware reported that attackers attempted to access their backup repositories, with 34% of these repositories being modified or deleted. Data from the ESA Pro cybersecurity center indicates that approximately 20% of business attacks in 2025 involved ransomware.
To protect backups, cloud providers implement Object Lock using the WORM (write once, read many) model. This mechanism prevents objects from being deleted or overwritten until a specified retention period expires. The protection operates at the storage level, meaning it cannot be bypassed via backup application APIs, even if an attacker gains administrative credentials.
There are three primary modes of Object Lock: Governance, Compliance, and Legal Hold. Governance allows users with specific privileges to remove the lock prematurely, protecting against accidental deletion. Compliance is a strict mode where no one, including the project owner, can remove the lock until the period expires. Legal Hold provides indefinite protection for audit or legal purposes.
Settings for Object Lock must be configured when creating a bucket and cannot be changed later. In VK Cloud, users can create up to five backup buckets per project. The service automates the process by creating specific buckets based on the selected lock mode. Immutable backups are currently available for virtual machines and their disks, but not for managed databases.
Choosing the correct retention period is critical for cost management, as Compliance mode does not allow for premature deletion of data. It is recommended to use shorter periods with extensions rather than long, fixed terms. Additionally, the immutability of backups does not affect recovery time objectives (RTO), which depend on the chain of incremental backups and the volume of data.
