Stats
Actions
Tags
From cybersec-toolkit
Implements immutable backups using restic with S3-compatible storage and object lock for ransomware-resistant protection. Automates backup creation, integrity verification via restic check --read-data, retention policy, and restore testing for AWS S3, MinIO, Backblaze B2.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:implementing-immutable-backup-with-resticThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
- Establishing ransomware-resistant backup infrastructure with cryptographic integrity verification
Do not use as the sole backup solution without also maintaining offline/air-gapped copies. Object lock protects against logical deletion but not physical storage failure.
Create an encrypted restic repository on S3-compatible storage with object lock enabled. Restic uses AES-256-CTR for encryption with Poly1305-AES for authentication, ensuring backup data is both confidential and tamper-evident.
Enable S3 Object Lock in Compliance mode on the backup bucket to prevent any principal (including root) from deleting or modifying objects during the retention period. Set retention to match your backup window requirements (typically 30-90 days).
Schedule backup operations with post-backup integrity verification using restic check --read-data which downloads and verifies every data blob against its stored checksum. Log results and alert on any integrity failures.
Periodically restore random files from backup snapshots to a temporary location and compare checksums against the original to validate end-to-end backup integrity. Document restore times for RTO planning.
| Term | Definition |
|---|---|
| Object Lock | S3 feature that prevents object deletion or overwrite for a specified retention period |
| Compliance Mode | Object Lock mode where even the root account cannot delete objects before retention expires |
| Deduplication | Restic stores data in content-addressable chunks, deduplicating across all snapshots |
| 3-2-1-1-0 | 3 copies, 2 media types, 1 offsite, 1 immutable, 0 errors in verification |
BACKUP VERIFICATION REPORT
===========================
Repository: s3:s3.amazonaws.com/company-backups-immutable
Snapshots: 45
Total Size: 2.3 TiB (deduplicated from 8.7 TiB)
Last Backup: 2026-03-11T02:00:00Z
Integrity Check: PASSED (all packs verified)
Object Lock: Compliance mode, 90-day retention
Restore Test: PASSED (15 files verified)
npx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitImplements immutable backups using restic with S3-compatible storage and object lock for ransomware-resistant protection. Automates backup creation, integrity verification via restic check --read-data, retention policy, and restore testing for AWS S3, MinIO, Backblaze B2.
Implements immutable backup strategy using restic with S3-compatible storage and object lock for ransomware-resistant data protection. Automates backup creation, integrity verification, snapshot retention, and restore testing.
Implements immutable backups using restic with S3-compatible storage and object locking for ransomware protection. Automates creation, integrity verification via restic check --read-data, retention policies, and restore tests with AWS S3, MinIO, Backblaze B2.