I don’t know if it is the „correct“ way but I do it the other way around. I have a server and a backup server. Server user can‘t even see backup server but packs a backup, backup server pulls the data with read only access, main server deletes backup, done.

For an organisation hosting as many companies data as this one I’d expect automated tape at a minimum. Of course, if the attacker had the time to start messing with the tape that’s lost as well but it’s unlikely.

Fundamentally there’s no need for the user/account that saves the backup somewhere to be able to read let alone change/delete it.

So ideally you have “write-only” credentials that can only append/add new files.

How exactly that is implemented depends on the tech. S3 and S3 compatible systems can often be configured that data straight up can’t be deleted from a bucket at all.

A tape library that uses a robot arm https://youtu.be/sYgnCWOVysY?t=30s

Backups that are not connected to any device are not susceptible to being overwritten and encrypted by malware.

i use immutable objects on backblaze b2

from command line using their tool is something like b2 sync SOURCE BUCKET

and from the bucket setting disable object deletion

also borgbase allows this, backups can be created but deletions/overwrites are not permanent (unless you enabled them)