← Back to context

Comment by UltraSane

1 day ago

Enterprise storage arrays have immutable snapshot functionality that makes ransomware easy to recover from.

What does it take to delete a snapshot?

  • Depends on the vendor. Some just admin access to the array, other require a two person authorization to delete it.

  • local admin credentials or two factor or the BEST is a immutable time-lock, so a snapshot cannot be deleted before the retention period that was set when it was taken expires