{"id":6381,"date":"2026-06-19T13:54:43","date_gmt":"2026-06-19T13:54:43","guid":{"rendered":"https:\/\/cloudsave.app\/knowledge-base\/immutable-database-storage-ransomware\/"},"modified":"2026-06-19T14:12:27","modified_gmt":"2026-06-19T14:12:27","slug":"arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus","status":"publish","type":"post","link":"https:\/\/cloudsave.app\/lv\/knowledge-base\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\/","title":{"rendered":"Arhitekt\u016bras izveide nemain\u012bgai kr\u0101tuvei datub\u0101\u017eu arh\u012bviem, lai uzveiktu izspied\u0113jv\u012brusus"},"content":{"rendered":"<p>M\u016bsdienu apdraud\u0113jumu vid\u0113 izspied\u0113jv\u012brusi ir att\u012bst\u012bju\u0161ies no oport\u016bnistiskas \u0161ifr\u0113\u0161anas l\u012bdz m\u0113r\u0137tiec\u012bg\u0101m, daudzpak\u0101pju izspie\u0161anas kampa\u0146\u0101m. Uzlaboto past\u0101v\u012bgo draudu (APT) grupas un izspied\u0113jv\u012brusu sindik\u0101ti tagad akt\u012bvi mekl\u0113 rezerves kopiju infrastrukt\u016bru un datub\u0101\u017eu arh\u012bvus savas uztur\u0113\u0161an\u0101s laik\u0101 sist\u0113m\u0101. Ja uzbruc\u0113js kompromit\u0113 j\u016bsu prim\u0101ro datub\u0101zi un vienlaikus izdz\u0113\u0161 vai \u0161ifr\u0113 j\u016bsu rezerves kopiju kr\u0101tuves, j\u016bsu organiz\u0101cija saskaras ar katastrof\u0101lu datu zudumu.<\/p>\n<p>Datub\u0101\u017eu administratoriem (DBA) un DevOps in\u017eenieriem tradicion\u0101l\u0101 3-2-1 rezerves kopiju strat\u0113\u0123ija vairs nav pietiekama. Lai garant\u0113tu datu izdz\u012bvo\u0161anu, infrastrukt\u016bras komand\u0101m ir j\u0101pie\u0146em 3-2-1-1 noteikums, kur p\u0113d\u0113jais &#8220;1&#8221; apz\u012bm\u0113 <strong>nemain\u012bgu (immutable) kr\u0101tuvi<\/strong>.<\/p>\n<p>\u0160aj\u0101 rakst\u0101 ir sniegts visaptvero\u0161s, tehnisks ieskats nemain\u012bgas kr\u0101tuves arhitekt\u016bras izstr\u0101d\u0113, ievie\u0161an\u0101 un p\u0101rvald\u012bb\u0101 datub\u0101\u017eu arh\u012bviem, lai nodro\u0161in\u0101tu absol\u016btu notur\u012bbu pret izspied\u0113jv\u012brusiem.<\/p>\n<h2>Nemain\u012bgas kr\u0101tuves meh\u0101nika<\/h2>\n<p>Nemain\u012bga kr\u0101tuve balst\u0101s uz WORM (Write-Once-Read-Many \u2013 rakst\u012bt vienreiz, las\u012bt daudzk\u0101rt) arhitekt\u016bru. Kad dati ir ierakst\u012bti nemain\u012bg\u0101 m\u0113r\u0137viet\u0101, tos nevar modific\u0113t, \u0161ifr\u0113t vai izdz\u0113st neviens lietot\u0101js, tostarp administratori ar root privil\u0113\u0123ij\u0101m vai kompromit\u0113ti pakalpojumu konti, l\u012bdz beidzas matem\u0101tiski noteiktais laika ierobe\u017eojums.<\/p>\n<h3>Atbilst\u012bbas re\u017e\u012bms (Compliance Mode) pret P\u0101rvald\u012bbas re\u017e\u012bmu (Governance Mode)<\/h3>\n<p>Ievie\u0161ot nemain\u012bgumu, \u012bpa\u0161i m\u0101ko\u0146a objektu kr\u0101tuv\u0113s, piem\u0113ram, AWS S3, Azure Blob vai S3 sader\u012bg\u0101s lok\u0101l\u0101s SAN sist\u0113m\u0101s, ir j\u0101saprot at\u0161\u0137ir\u012bba starp saglab\u0101\u0161anas re\u017e\u012bmiem:<\/p>\n<ul>\n<li><strong>P\u0101rvald\u012bbas re\u017e\u012bms (Governance Mode):<\/strong> Ne\u013cauj standarta lietot\u0101jiem dz\u0113st vai main\u012bt objektus. Tom\u0113r lietot\u0101ji ar \u012bpa\u0161\u0101m IAM at\u013cauj\u0101m (piem., <code>s3:BypassGovernanceRetention<\/code>) var apiet \u0161o blo\u0137\u0113\u0161anu. Tas ir noder\u012bgi test\u0113\u0161anai, bet <strong>nepietiekami aizsardz\u012bbai pret izspied\u0113jv\u012brusiem<\/strong>, jo uzbruc\u0113ji bie\u017ei paaugstina privil\u0113\u0123ijas l\u012bdz dom\u0113na administratora vai root l\u012bmenim.<\/li>\n<li><strong>Atbilst\u012bbas re\u017e\u012bms (Compliance Mode):<\/strong> Zelta standarts aizsardz\u012bbai pret izspied\u0113jv\u012brusiem. Kad objekts ir blo\u0137\u0113ts atbilst\u012bbas re\u017e\u012bm\u0101, t\u0101 saglab\u0101\u0161anas periodu nevar sa\u012bsin\u0101t, un objektu nevar izdz\u0113st <em>neviens<\/em>, tostarp AWS root konts. Blo\u0137\u0113\u0161ana tiek \u012bstenota kr\u0101tuves klastera l\u012bmen\u012b.<\/li>\n<\/ul>\n<h2>Nemain\u012bgas rezerves kopiju cauru\u013cvada arhitekt\u016bra<\/h2>\n<p>Robust\u0101 datub\u0101\u017eu arhiv\u0113\u0161anas arhitekt\u016bra atdala akt\u012bv\u0101s datub\u0101\u017eu darb\u012bbas no nemain\u012bg\u0101 arh\u012bva l\u012bme\u0146a. J\u016bs nevarat piem\u0113rot nemain\u012bgumu akt\u012bviem datub\u0101\u017eu failiem (piem\u0113ram, <code>.mdf<\/code>\/<code>.ldf<\/code> SQL Server vai <code>pg_data<\/code> direktorijai PostgreSQL), jo datub\u0101z\u0113m ir nepiecie\u0161ama past\u0101v\u012bga las\u012b\u0161anas\/rakst\u012b\u0161anas piek\u013cuve.<\/p>\n<p>T\u0101 viet\u0101 nemain\u012bgums tiek piem\u0113rots:<br \/>\n1.  <strong>Piln\u0101m un diferenci\u0101laj\u0101m rezerves kopij\u0101m:<\/strong> Datub\u0101zes b\u0101zes momentuz\u0146\u0113mumiem.<br \/>\n2.  <strong>Transakciju \u017eurn\u0101liem \/ WAL failiem:<\/strong> Past\u0101v\u012bgai datub\u0101zes izmai\u0146u pl\u016bsmai, kas nepiecie\u0161ama atjauno\u0161anai uz noteiktu laika punktu (Point-in-Time Recovery \u2014 PITR).<\/p>\n<h3>Kr\u0101tuvju m\u0113r\u0137i nemain\u012bgumam<\/h3>\n<p>J\u016bs varat ieviest nemain\u012bgu kr\u0101tuvi da\u017e\u0101dos infrastrukt\u016bras l\u012bme\u0146os:<br \/>\n*   <strong>M\u0101ko\u0146a objektu kr\u0101tuve:<\/strong> AWS S3 Object Lock, Azure Blob Immutable Storage, Google Cloud Storage Retention Policies.<br \/>\n*   <strong>Lok\u0101l\u0101 objektu kr\u0101tuve:<\/strong> MinIO, Cloudian vai Pure Storage FlashBlade, kas atbalsta S3 Object Lock API.<br \/>\n*   <strong>Bloku\/failu kr\u0101tuve:<\/strong> ZFS ar tikai las\u0101miem momentuz\u0146\u0113mumiem un dele\u0123\u0113tu administr\u0113\u0161anu vai Linux failu atrib\u016btiem.<\/p>\n<h2>Nemain\u012bgas kr\u0101tuves ievie\u0161ana: Tehniskie nor\u0101d\u012bjumi<\/h2>\n<h3>1. M\u0101ko\u0146a objektu kr\u0101tuve: AWS S3 Object Lock<\/h3>\n<p>Lai aizsarg\u0101tu datub\u0101\u017eu izg\u0101zumus (dumps) un transakciju \u017eurn\u0101lus AWS, jums ir j\u0101iesp\u0113jo Object Lock br\u012bd\u012b, kad tiek izveidots &#8220;bucket&#8221; (kr\u0101tuves konteiners).<\/p>\n<p>Vispirms izveidojiet &#8220;bucket&#8221; ar iesp\u0113jotu Object Lock:<\/p>\n<pre><code class=\"language-bash\">aws s3api create-bucket \n    --bucket prod-db-archive-immutable \n    --region us-east-1 \n    --object-lock-enabled-for-bucket\n<\/code><\/pre>\n<p>P\u0113c tam konfigur\u0113jiet noklus\u0113juma saglab\u0101\u0161anas politiku. Datub\u0101\u017eu arh\u012bviem 30 dienu atbilst\u012bbas blo\u0137\u0113\u0161ana ir standarta b\u0101zes l\u012bnija, kas nodro\u0161ina, ka jums ir m\u0113nesi ilgas nemain\u012bgas rezerves kopijas.<\/p>\n<pre><code class=\"language-bash\">aws s3api put-object-lock-configuration \n    --bucket prod-db-archive-immutable \n    --object-lock-configuration '{\n        &quot;ObjectLockEnabled&quot;: &quot;Enabled&quot;,\n        &quot;Rule&quot;: {\n            &quot;DefaultRetention&quot;: {\n                &quot;Mode&quot;: &quot;COMPLIANCE&quot;,\n                &quot;Days&quot;: 30\n            }\n        }\n    }'\n<\/code><\/pre>\n<p>Kad j\u016bsu datub\u0101zes rezerves kopiju skripts vai a\u0123ents nos\u016bta failu uz \u0161o &#8220;bucket&#8221;, S3 autom\u0101tiski apr\u0113\u0137ina <code>Retain Until Date<\/code> (saglab\u0101t l\u012bdz datumam), pamatojoties uz objekta izveides laika z\u012bmogu plus 30 dien\u0101m.<\/p>\n<h3>2. Lok\u0101l\u0101 nemain\u012bba: ZFS un Linux atrib\u016bti<\/h3>\n<p>Ja arhiv\u0113jat datub\u0101zes uz lok\u0101la Linux rezerves kopiju servera, varat pan\u0101kt pseido-nemain\u012bbu, izmantojot <code>chattr<\/code> komandu, vai patiesu nemain\u012bbu, izmantojot ZFS momentuz\u0146\u0113mumus.<\/p>\n<p><strong>Izmantojot Linux <code>chattr<\/code>:<\/strong><br \/>\n<code>+i<\/code> (immutable) karodzi\u0146\u0161 nov\u0113r\u0161 faila modific\u0113\u0161anu, dz\u0113\u0161anu vai p\u0101rd\u0113v\u0113\u0161anu.<\/p>\n<pre><code class=\"language-bash\"># Izveidot datub\u0101zes izg\u0101zumu\npg_dump -U postgres -Fc mydb &gt; \/backups\/mydb_$(date +%F).dump\n\n# Padar\u012bt rezerves kopiju nemain\u012bgu\nsudo chattr +i \/backups\/mydb_$(date +%F).dump\n\n# P\u0101rbaud\u012bt atrib\u016btu\nlsattr \/backups\/mydb_$(date +%F).dump\n# Izvade: ----i---------e------- \/backups\/mydb_2023-10-27.dump\n<\/code><\/pre>\n<p><em>Piez\u012bme: Lai gan <code>chattr<\/code> aptur pamata izspied\u0113jv\u012brusu skriptus, izsmalcin\u0101ts uzbruc\u0113js ar root piek\u013cuvi var vienk\u0101r\u0161i izpild\u012bt <code>chattr -i<\/code>. T\u0101p\u0113c tas ir j\u0101apvieno ar stingru RBAC un izol\u0113tiem rezerves kopiju t\u012bkliem.<\/em><\/p>\n<p><strong>Izmantojot ZFS momentuz\u0146\u0113mumus:<\/strong><br \/>\nZFS nodro\u0161ina daudz sp\u0113c\u012bg\u0101ku aizsardz\u012bbu. Izveidojot momentuz\u0146\u0113mumu un uzliekot tam &#8220;aizturi&#8221; (hold), j\u016bs nov\u0113r\u0161at momentuz\u0146\u0113muma izn\u012bcin\u0101\u0161anu.<\/p>\n<pre><code class=\"language-bash\"># Izveidot rezerves kopiju datu kopas momentuz\u0146\u0113mumu\nzfs snapshot tank\/db_backups@archive_$(date +%F)\n\n# Uzlikt aizturi momentuz\u0146\u0113mumam, lai nov\u0113rstu dz\u0113\u0161anu\nzfs hold keep_30_days tank\/db_backups@archive_$(date +%F)\n\n# Pat root nevar izn\u012bcin\u0101t \u0161o momentuz\u0146\u0113mumu, neatbr\u012bvojot aizturi\nzfs destroy tank\/db_backups@archive_$(date +%F)\n# Izvade: cannot destroy 'tank\/db_backups@archive_...': dataset is busy\n<\/code><\/pre>\n<h2>Datub\u0101z\u0113m specifiskas arhiv\u0113\u0161anas strat\u0113\u0123ijas<\/h2>\n<p>Lai pan\u0101ktu atjauno\u0161anu uz noteiktu laika punktu (PITR), jums ir nep\u0101rtraukti j\u0101arhiv\u0113 transakciju \u017eurn\u0101li sav\u0101 nemain\u012bgaj\u0101 kr\u0101tuv\u0113.<\/p>\n<h3>PostgreSQL WAL arhiv\u0113\u0161ana ar pgBackRest<\/h3>\n<p><code>pgBackRest<\/code> ir \u013coti uzticams rezerves kopiju r\u012bks PostgreSQL, kas nat\u012bvi atbalsta S3 sader\u012bgu kr\u0101tuvi. Lai aizsarg\u0101tu savus Write-Ahead Logs (WAL), konfigur\u0113jiet <code>pgBackRest<\/code> s\u016bt\u012bt datus tie\u0161i uz j\u016bsu nemain\u012bgo S3 &#8220;bucket&#8221;.<\/p>\n<p>J\u016bsu <code>pgbackrest.conf<\/code> fail\u0101:<\/p>\n<pre><code class=\"language-ini\">[global]\nrepo1-type=s3\nrepo1-s3-bucket=prod-db-archive-immutable\nrepo1-s3-region=us-east-1\nrepo1-s3-endpoint=s3.amazonaws.com\nrepo1-s3-key=AKIAIOSFODNN7EXAMPLE\nrepo1-s3-key-secret=wJalrXUtnFEMI\/K7MDENG\/bPxRfiCYEXAMPLEKEY\n\n# Nodro\u0161iniet, ka saglab\u0101\u0161anas termi\u0146\u0161 atbilst j\u016bsu S3 Object Lock konfigur\u0101cijai\nrepo1-retention-full=2\nrepo1-retention-archive=2\n\n[prod_cluster]\npg1-path=\/var\/lib\/postgresql\/14\/main\n<\/code><\/pre>\n<p><em>Svar\u012bgs apsv\u0113rums:<\/em> Ja j\u016bsu S3 &#8220;bucket&#8221; piem\u0113ro 30 dienu atbilst\u012bbas blo\u0137\u0113\u0161anu, bet <code>pgBackRest<\/code> m\u0113\u0123ina izbeigt un izdz\u0113st WAL failus p\u0113c 14 dien\u0101m, pamatojoties uz <code>repo1-retention-archive<\/code>, dz\u0113\u0161anas API izsaukumi neizdosies. Jums ir j\u0101p\u0101rliecin\u0101s, ka j\u016bsu rezerves kopiju programmat\u016bras saglab\u0101\u0161anas politika ir vien\u0101da vai gar\u0101ka par kr\u0101tuves l\u012bme\u0146a nemain\u012bgo blo\u0137\u0113\u0161anu.<\/p>\n<h3>Microsoft SQL Server: Rezerves kopija uz URL<\/h3>\n<p>SQL Server atbalsta nat\u012bvas rezerves kopijas tie\u0161i uz S3 sader\u012bgu objektu kr\u0101tuvi. Varat konfigur\u0113t SQL Server Agent darbu, lai rakst\u012btu <code>.bak<\/code> un <code>.trn<\/code> failus tie\u0161i uz nemain\u012bgu &#8220;bucket&#8221;.<\/p>\n<pre><code class=\"language-sql\">CREATE CREDENTIAL [s3:\/\/prod-db-archive-immutable.s3.us-east-1.amazonaws.com]\nWITH IDENTITY = 'S3 Access Key',\nSECRET = 'AccessKeyID:SecretAccessKey';\nGO\n\nBACKUP DATABASE [ProductionDB]\nTO URL = 's3:\/\/prod-db-archive-immutable.s3.us-east-1.amazonaws.com\/ProductionDB_Full.bak'\nWITH FORMAT, COMPRESSION, STATS = 10;\nGO\n<\/code><\/pre>\n<h2>Automatiz\u0101cija un or\u0137estr\u0113\u0161ana ar CloudSave<\/h2>\n<p>Nemain\u012bgo saglab\u0101\u0161anas karodzi\u0146u p\u0101rvald\u012bba, piek\u013cuves atsl\u0113gu rot\u0101cija un sinhroniz\u0101cijas nodro\u0161in\u0101\u0161ana starp datub\u0101\u017eu saglab\u0101\u0161anas politik\u0101m un kr\u0101tuvju blo\u0137\u0113\u0161anu, izmantojot piel\u0101gotus skriptus, ir \u013coti pak\u013cauta k\u013c\u016bd\u0101m. Viena nepareiza konfigur\u0101cija cron darb\u0101 vai API izsaukum\u0101 var atst\u0101t j\u016bsu arh\u012bvus neaizsarg\u0101tus vai izrais\u012bt strauju m\u0101ko\u0146a kr\u0101tuves izmaksu pieaugumu d\u0113\u013c atst\u0101tiem, blo\u0137\u0113tiem objektiem.<\/p>\n<p>Uz\u0146\u0113muma l\u012bme\u0146a rezerves kopiju platformas, piem\u0113ram, CloudSave, vienk\u0101r\u0161o \u0161o arhitekt\u016bru. CloudSave nat\u012bvi integr\u0113jas ar AWS S3 Object Lock, Azure Blob Immutable Storage un lok\u0101l\u0101m S3 sader\u012bg\u0101m API.<\/p>\n<p>Konfigur\u0113jot datub\u0101zes rezerves kopiju pl\u0101nu CloudSave:<br \/>\n1.  Platforma autom\u0101tiski apstr\u0101d\u0101 VSS (Volume Shadow Copy Service) klus\u0113\u0161anu SQL Server vai <code>pg_start_backup()<\/code> API PostgreSQL.<br \/>\n2.  T\u0101 straum\u0113 dedubl\u0113tus, \u0161ifr\u0113tus rezerves kopiju datus tie\u0161i uz kr\u0101tuves m\u0113r\u0137i.<br \/>\n3.  CloudSave dinamiski piem\u0113ro WORM API izsaukumus (piem., <code>PutObjectRetention<\/code>) katram objektam atsevi\u0161\u0137i, perfekti saska\u0146ojot kr\u0101tuves blo\u0137\u0113\u0161anas ilgumu ar politik\u0101 defin\u0113to saglab\u0101\u0161anas grafiku.<br \/>\n4.  Ja uzbruc\u0113js kompromit\u0113 CloudSave p\u0101rvald\u012bbas konsoli, vi\u0146\u0161 joproj\u0101m nevar izdz\u0113st rezerves kopijas, jo atbilst\u012bbas blo\u0137\u0113\u0161anu \u012bsteno pamat\u0101 eso\u0161\u0101 kr\u0101tuves infrastrukt\u016bra, nevis rezerves kopiju programmat\u016bra.<\/p>\n<h2>Lab\u0101k\u0101 prakse nemain\u012bgiem datub\u0101\u017eu arh\u012bviem<\/h2>\n<p>Lai nodro\u0161in\u0101tu, ka j\u016bsu nemain\u012bg\u0101 arhitekt\u016bra ir patiesi notur\u012bga, iev\u0113rojiet \u0161\u0101du sist\u0113mu in\u017eenierijas lab\u0101ko praksi:<\/p>\n<h3>1. Stingra NTP sinhroniz\u0101cija<\/h3>\n<p>Nemain\u012bg\u0101s blo\u0137\u0113\u0161anas ir matem\u0101tiski piesaist\u012btas laika z\u012bmogiem. Ja NTP (Network Time Protocol) pakalpojums j\u016bsu kr\u0101tuvju mas\u012bv\u0101 vai rezerves kopiju server\u012b ir kompromit\u0113ts vai nob\u012bd\u0101s, tas var izrais\u012bt blo\u0137\u0113\u0161anas priek\u0161laic\u012bgu beig\u0161anos vai to, ka t\u0101s nekad nebeidzas. Nodro\u0161iniet, ka j\u016bsu kr\u0101tuvju infrastrukt\u016bra izmanto autentific\u0113tus, redundantus NTP avotus.<\/p>\n<h3>2. Izol\u0113jiet IAM lomas un akredit\u0101cijas datus<\/h3>\n<p>Akredit\u0101cijas datiem, ko izmanto rakst\u012b\u0161anai uz nemain\u012bgo &#8220;bucket&#8221;, j\u0101b\u016bt tikai <code>s3:PutObject<\/code> un <code>s3:PutObjectRetention<\/code> at\u013cauj\u0101m. Tiem <strong>nekad<\/strong> nevajadz\u0113tu b\u016bt <code>s3:DeleteObject<\/code> vai <code>s3:PutBucketObjectLockConfiguration<\/code> at\u013cauj\u0101m.<\/p>\n<p>Piem\u0113rs minim\u0101lo privil\u0113\u0123iju IAM politikai datub\u0101zes rezerves kopiju a\u0123entam:<\/p>\n<pre><code class=\"language-json\">{\n    &quot;Version&quot;: &quot;2012-10-17&quot;,\n    &quot;Statement&quot;: [\n        {\n            &quot;Effect&quot;: &quot;Allow&quot;,\n            &quot;Action&quot;: [\n                &quot;s3:PutObject&quot;,\n                &quot;s3:GetBucketObjectLockConfiguration&quot;\n            ],\n            &quot;Resource&quot;: [\n                &quot;arn:aws:s3:::prod-db-archive-immutable&quot;,\n                &quot;arn:aws:s3:::prod-db-archive-immutable\/*&quot;\n            ]\n        }\n    ]\n}\n<\/code><\/pre>\n<h3>3. Saglab\u0101\u0161anas perioda noteik\u0161ana<\/h3>\n<p>Neiestatiet atbilst\u012bbas blo\u0137\u0113\u0161anu uz p\u0101rm\u0113r\u012bgi ilgiem periodiem (piem., 7 gadiem atbilst\u012bbas nodro\u0161in\u0101\u0161anai) sav\u0101 prim\u0101raj\u0101 \u0101tr\u0101s atjauno\u0161anas l\u012bmen\u012b. Datub\u0101zes \u0123ener\u0113 milz\u012bgu daudzumu WAL\/transakciju \u017eurn\u0101lu datu. \u0160o datu blo\u0137\u0113\u0161ana gadiem ilgi rad\u012bs eksponenci\u0101lu kr\u0101tuves izmaksu pieaugumu.<br \/>\nT\u0101 viet\u0101 izmantojiet l\u012bme\u0146veida pieeju:<br \/>\n*   <strong>Operat\u012bv\u0101s atjauno\u0161anas l\u012bmenis:<\/strong> 14 l\u012bdz 30 dienu nemain\u012bga saglab\u0101\u0161ana piln\u0101m kopij\u0101m un \u017eurn\u0101liem.<br \/>\n*   <strong>Ilgtermi\u0146a arhiv\u0113\u0161anas l\u012bmenis:<\/strong> Ikm\u0113ne\u0161a pilnas rezerves kopijas, kas p\u0101rvietotas uz Glacier\/Deep Archive ar Vault Lock uz 1-7 gadiem.<\/p>\n<h3>4. Regul\u0101ra atjauno\u0161anas test\u0113\u0161ana izol\u0113tos (air-gapped) VPC<\/h3>\n<p>Nemain\u012bgums garant\u0113, ka datus nevar izdz\u0113st, bet tas negarant\u0113, ka dati ir br\u012bvi no lo\u0123iskiem boj\u0101jumiem. Jums ir j\u0101automatiz\u0113 savu nemain\u012bgo datub\u0101\u017eu arh\u012bvu atjauno\u0161ana izol\u0113t\u0101, no t\u012bkla atdal\u012bt\u0101 (air-gapped) VPC vai VLAN. Palaidiet <code>DBCC CHECKDB<\/code> (SQL Server) vai <code>pg_amcheck<\/code> (PostgreSQL) uz atjaunotajiem datiem, lai p\u0101rbaud\u012btu struktur\u0101lo integrit\u0101ti.<\/p>\n<h2>Secin\u0101jums<\/h2>\n<p>Aizsardz\u012bba pret izspied\u0113jv\u012brusiem ir vingrin\u0101jums, pie\u0146emot, ka ielau\u0161an\u0101s notiks. L\u012bdz br\u012bdim, kad j\u016bsu SIEM sist\u0113m\u0101 atskan br\u012bdin\u0101jums, draudu dal\u012bbnieki, visticam\u0101k, jau ir m\u0113\u0123in\u0101ju\u0161i kompromit\u0113t j\u016bsu rezerves kopiju infrastrukt\u016bru. Izstr\u0101d\u0101jot savu datub\u0101\u017eu arh\u012bvu arhitekt\u016bru, izmantojot nemain\u012bgu kr\u0101tuvi atbilst\u012bbas re\u017e\u012bm\u0101, j\u016bs at\u0146emat uzbruc\u0113jiem to galveno sviru. Neatkar\u012bgi no t\u0101, vai izmantojat nat\u012bvas m\u0101ko\u0146a API, ZFS aiztures vai uz\u0146\u0113muma or\u0137estr\u0113\u0161anas platformu, piem\u0113ram, CloudSave, WORM kr\u0101tuves ievie\u0161ana vairs nav izv\u0113les iesp\u0113ja \u2014 tas ir oblig\u0101ts m\u016bsdienu datub\u0101\u017eu administr\u0113\u0161anas un katastrofu seku nov\u0113r\u0161anas p\u012bl\u0101rs.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>** Learn how to protect enterprise database archives from ransomware using immutable storage. Discover technical implementation steps for AWS S3 Object Lock, ZFS, PostgreSQL, and SQL Server.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_title":"Immutable Database Storage to Defeat Ransomware","rank_math_description":"** Learn how to protect enterprise database archives from ransomware using immutable storage. Discover technical implementation steps for AWS S3 Object Lock, ZFS, PostgreSQL, and SQL Server.","rank_math_focus_keyword":"immutable database storage","footnotes":""},"categories":[535],"tags":[4665,4666,4667,1319,4668,4669],"class_list":["post-6381","post","type-post","status-publish","format-standard","hentry","category-database-backup","tag-3-2-1-1-backup","tag-data-survivability","tag-database-archives","tag-enterprise-backup","tag-immutable-storage","tag-ransomware-protection"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.7 (Yoast SEO v27.7) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Immutable Database Storage to Defeat Ransomware<\/title>\n<meta name=\"description\" content=\"** Learn how to protect enterprise database archives from ransomware using immutable storage. Discover technical implementation steps for AWS S3 Object Lock, ZFS, PostgreSQL, and SQL Server.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cloudsave.app\/lv\/knowledge-base\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\/\" \/>\n<meta property=\"og:locale\" content=\"lv_LV\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Arhitekt\u016bras izveide nemain\u012bgai kr\u0101tuvei datub\u0101\u017eu arh\u012bviem, lai uzveiktu izspied\u0113jv\u012brusus\" \/>\n<meta property=\"og:description\" content=\"** Learn how to protect enterprise database archives from ransomware using immutable storage. Discover technical implementation steps for AWS S3 Object Lock, ZFS, PostgreSQL, and SQL Server.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cloudsave.app\/lv\/knowledge-base\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\/\" \/>\n<meta property=\"og:site_name\" content=\"CloudSave\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-19T13:54:43+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-06-19T14:12:27+00:00\" \/>\n<meta name=\"author\" content=\"shervinrv\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"shervinrv\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 min\u016b\u0161u\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cloudsave.app\\\/lv\\\/knowledge-base\\\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cloudsave.app\\\/lv\\\/knowledge-base\\\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\\\/\"},\"author\":{\"name\":\"shervinrv\",\"@id\":\"https:\\\/\\\/cloudsave.app\\\/lv\\\/#\\\/schema\\\/person\\\/286beefe68281d868e87f46603a7ae4d\"},\"headline\":\"Arhitekt\u016bras izveide nemain\u012bgai kr\u0101tuvei datub\u0101\u017eu arh\u012bviem, lai uzveiktu izspied\u0113jv\u012brusus\",\"datePublished\":\"2026-06-19T13:54:43+00:00\",\"dateModified\":\"2026-06-19T14:12:27+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cloudsave.app\\\/lv\\\/knowledge-base\\\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\\\/\"},\"wordCount\":1780,\"publisher\":{\"@id\":\"https:\\\/\\\/cloudsave.app\\\/lv\\\/#\\\/schema\\\/person\\\/286beefe68281d868e87f46603a7ae4d\"},\"keywords\":[\"3-2-1-1 backup\",\"data survivability\",\"database archives\",\"Enterprise Backup\",\"immutable storage\",\"ransomware protection\"],\"articleSection\":[\"Database Backup\"],\"inLanguage\":\"lv-LV\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cloudsave.app\\\/lv\\\/knowledge-base\\\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\\\/\",\"url\":\"https:\\\/\\\/cloudsave.app\\\/lv\\\/knowledge-base\\\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\\\/\",\"name\":\"Immutable Database Storage to Defeat Ransomware\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cloudsave.app\\\/lv\\\/#website\"},\"datePublished\":\"2026-06-19T13:54:43+00:00\",\"dateModified\":\"2026-06-19T14:12:27+00:00\",\"description\":\"** Learn how to protect enterprise database archives from ransomware using immutable storage. Discover technical implementation steps for AWS S3 Object Lock, ZFS, PostgreSQL, and SQL Server.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cloudsave.app\\\/lv\\\/knowledge-base\\\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\\\/#breadcrumb\"},\"inLanguage\":\"lv-LV\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cloudsave.app\\\/lv\\\/knowledge-base\\\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cloudsave.app\\\/lv\\\/knowledge-base\\\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cloudsave.app\\\/lv\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Arhitekt\u016bras izveide nemain\u012bgai kr\u0101tuvei datub\u0101\u017eu arh\u012bviem, lai uzveiktu izspied\u0113jv\u012brusus\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cloudsave.app\\\/lv\\\/#website\",\"url\":\"https:\\\/\\\/cloudsave.app\\\/lv\\\/\",\"name\":\"CloudSave\",\"description\":\"CloudSave\",\"publisher\":{\"@id\":\"https:\\\/\\\/cloudsave.app\\\/lv\\\/#\\\/schema\\\/person\\\/286beefe68281d868e87f46603a7ae4d\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cloudsave.app\\\/lv\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"lv-LV\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/cloudsave.app\\\/lv\\\/#\\\/schema\\\/person\\\/286beefe68281d868e87f46603a7ae4d\",\"name\":\"shervinrv\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"lv-LV\",\"@id\":\"https:\\\/\\\/cloudsave.app\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/Logo_Name-2.png\",\"url\":\"https:\\\/\\\/cloudsave.app\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/Logo_Name-2.png\",\"contentUrl\":\"https:\\\/\\\/cloudsave.app\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/Logo_Name-2.png\",\"width\":859,\"height\":150,\"caption\":\"shervinrv\"},\"logo\":{\"@id\":\"https:\\\/\\\/cloudsave.app\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/Logo_Name-2.png\"},\"sameAs\":[\"http:\\\/\\\/cloudsave.app\"],\"url\":\"https:\\\/\\\/cloudsave.app\\\/lv\\\/knowledge-base\\\/author\\\/shervinrv\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Immutable Database Storage to Defeat Ransomware","description":"** Learn how to protect enterprise database archives from ransomware using immutable storage. Discover technical implementation steps for AWS S3 Object Lock, ZFS, PostgreSQL, and SQL Server.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cloudsave.app\/lv\/knowledge-base\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\/","og_locale":"lv_LV","og_type":"article","og_title":"Arhitekt\u016bras izveide nemain\u012bgai kr\u0101tuvei datub\u0101\u017eu arh\u012bviem, lai uzveiktu izspied\u0113jv\u012brusus","og_description":"** Learn how to protect enterprise database archives from ransomware using immutable storage. Discover technical implementation steps for AWS S3 Object Lock, ZFS, PostgreSQL, and SQL Server.","og_url":"https:\/\/cloudsave.app\/lv\/knowledge-base\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\/","og_site_name":"CloudSave","article_published_time":"2026-06-19T13:54:43+00:00","article_modified_time":"2026-06-19T14:12:27+00:00","author":"shervinrv","twitter_card":"summary_large_image","twitter_misc":{"Written by":"shervinrv","Est. reading time":"10 min\u016b\u0161u"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cloudsave.app\/lv\/knowledge-base\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\/#article","isPartOf":{"@id":"https:\/\/cloudsave.app\/lv\/knowledge-base\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\/"},"author":{"name":"shervinrv","@id":"https:\/\/cloudsave.app\/lv\/#\/schema\/person\/286beefe68281d868e87f46603a7ae4d"},"headline":"Arhitekt\u016bras izveide nemain\u012bgai kr\u0101tuvei datub\u0101\u017eu arh\u012bviem, lai uzveiktu izspied\u0113jv\u012brusus","datePublished":"2026-06-19T13:54:43+00:00","dateModified":"2026-06-19T14:12:27+00:00","mainEntityOfPage":{"@id":"https:\/\/cloudsave.app\/lv\/knowledge-base\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\/"},"wordCount":1780,"publisher":{"@id":"https:\/\/cloudsave.app\/lv\/#\/schema\/person\/286beefe68281d868e87f46603a7ae4d"},"keywords":["3-2-1-1 backup","data survivability","database archives","Enterprise Backup","immutable storage","ransomware protection"],"articleSection":["Database Backup"],"inLanguage":"lv-LV"},{"@type":"WebPage","@id":"https:\/\/cloudsave.app\/lv\/knowledge-base\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\/","url":"https:\/\/cloudsave.app\/lv\/knowledge-base\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\/","name":"Immutable Database Storage to Defeat Ransomware","isPartOf":{"@id":"https:\/\/cloudsave.app\/lv\/#website"},"datePublished":"2026-06-19T13:54:43+00:00","dateModified":"2026-06-19T14:12:27+00:00","description":"** Learn how to protect enterprise database archives from ransomware using immutable storage. Discover technical implementation steps for AWS S3 Object Lock, ZFS, PostgreSQL, and SQL Server.","breadcrumb":{"@id":"https:\/\/cloudsave.app\/lv\/knowledge-base\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\/#breadcrumb"},"inLanguage":"lv-LV","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cloudsave.app\/lv\/knowledge-base\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/cloudsave.app\/lv\/knowledge-base\/arhitekt%c5%abras-izveide-nemain%c4%abgai-kr%c4%81tuvei-datub%c4%81%c5%beu-arh%c4%abviem-lai-uzveiktu-izspied%c4%93jv%c4%abrusus\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cloudsave.app\/lv\/"},{"@type":"ListItem","position":2,"name":"Arhitekt\u016bras izveide nemain\u012bgai kr\u0101tuvei datub\u0101\u017eu arh\u012bviem, lai uzveiktu izspied\u0113jv\u012brusus"}]},{"@type":"WebSite","@id":"https:\/\/cloudsave.app\/lv\/#website","url":"https:\/\/cloudsave.app\/lv\/","name":"CloudSave","description":"CloudSave","publisher":{"@id":"https:\/\/cloudsave.app\/lv\/#\/schema\/person\/286beefe68281d868e87f46603a7ae4d"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cloudsave.app\/lv\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"lv-LV"},{"@type":["Person","Organization"],"@id":"https:\/\/cloudsave.app\/lv\/#\/schema\/person\/286beefe68281d868e87f46603a7ae4d","name":"shervinrv","image":{"@type":"ImageObject","inLanguage":"lv-LV","@id":"https:\/\/cloudsave.app\/wp-content\/uploads\/2026\/02\/Logo_Name-2.png","url":"https:\/\/cloudsave.app\/wp-content\/uploads\/2026\/02\/Logo_Name-2.png","contentUrl":"https:\/\/cloudsave.app\/wp-content\/uploads\/2026\/02\/Logo_Name-2.png","width":859,"height":150,"caption":"shervinrv"},"logo":{"@id":"https:\/\/cloudsave.app\/wp-content\/uploads\/2026\/02\/Logo_Name-2.png"},"sameAs":["http:\/\/cloudsave.app"],"url":"https:\/\/cloudsave.app\/lv\/knowledge-base\/author\/shervinrv\/"}]}},"_links":{"self":[{"href":"https:\/\/cloudsave.app\/lv\/wp-json\/wp\/v2\/posts\/6381","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cloudsave.app\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cloudsave.app\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cloudsave.app\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cloudsave.app\/lv\/wp-json\/wp\/v2\/comments?post=6381"}],"version-history":[{"count":1,"href":"https:\/\/cloudsave.app\/lv\/wp-json\/wp\/v2\/posts\/6381\/revisions"}],"predecessor-version":[{"id":6443,"href":"https:\/\/cloudsave.app\/lv\/wp-json\/wp\/v2\/posts\/6381\/revisions\/6443"}],"wp:attachment":[{"href":"https:\/\/cloudsave.app\/lv\/wp-json\/wp\/v2\/media?parent=6381"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cloudsave.app\/lv\/wp-json\/wp\/v2\/categories?post=6381"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cloudsave.app\/lv\/wp-json\/wp\/v2\/tags?post=6381"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}