You should have an offsite backup. If for some reason you don't, you have options to secure a backup host. You can harden a backup host to prevent most every c

You should have an offsite backup. If for some reason you don't, you have options to secure a backup host. You can harden a backup host to prevent most every conceivable method to destroy the backup. You can lock down network access to prevent any connection but one to the file retrieving service itself, and prevent operations such as deletes or overwrites. You can use an append-only filesystem. You can use a SAN or NAS to allow a backup host access to one particular mount to dump files, and a different host can then move files off that mount onto a different mount that the backup host has no access to. Or you could even have "rotating backup hosts" that went effectively offline for a week at a time each, giving you several weeks worth of offline backups in case one backup server got compromised. But probably you should just do offsite backups.