1) enforce Yubikey authentication in addition to password for any server management interface (including hypervisor like esxi which gets abused by ransomware a

1) enforce Yubikey authentication in addition to password for any server management interface (including hypervisor like esxi which gets abused by ransomware a lot and of course SSH) 2) Restrict both read, write and modify permissions in Unix MAC permissions but also enforce it specifically for the data files using a LKM like selinux,apparmor or even the new and fancy eBPF LKM. 3) Enforce module signing and secure boot to prevent kernel mode code execution (short of an exploit) and of course harden your kernel. 4) This is shoddy, but if it were me I would have a LUKS encrypted backup partition with a detached header where the header and key are only fetched from a remote server temporarily from a and in-memory by a cron job/script to unlock it for a backup and lock it back again. That way, it requires a close examination of the cron script to figure out the partition is used for backup. Maybe even make the script itself remote exececuted by a simple 'curl ...|sh'