Object Lock

Object Lock is a mechanism in object storage with which stored objects are protected against modification and deletion for a defined period of time. In this way, immutability can be enforced technically instead of merely assured organizationally.

The principle was established with the S3 API, whose semantics many storage systems have adopted. Two modes are common: in governance mode, specially authorized accounts can lift locks in exceptional cases; in compliance mode, no one can do so before the period expires – not even an administrator. In addition, a legal hold prevents deletion regardless of periods, for example in ongoing proceedings. The lock periods follow the retention policies of the backup or archiving strategy.

In the backup environment, object lock is the technical basis of immutable backups: even with captured credentials, an attacker cannot destroy protected recovery points. Together with access controls and tested recovery processes, the mechanism is thus an effective building block of Ransomware Protection.