Cloud Backup Is Not a Backup Strategy—Here's What Actually Works

Your cloud provider's sync and snapshot features are not backups. Treating them as backups is the fastest way to lose data. I've seen teams rely on versioning and replication, only to watch a ransomware attack encrypt both primary and replica. The fix is boring: follow the 3-2-1-1-0 rule, set explicit RPO and RTO targets, and test restores.

What is the 3-2-1-1-0 rule, and why should I care?

The classic 3-2-1 rule says keep three copies of your data, on two different media, with one off-site. The modern twist adds one immutable or air-gapped copy and zero unverified backups—that's the 3-2-1-1-0 rule (CISA). Immutability means data can be locked after creation, preventing alteration or deletion (NIST SP 800-209). That locked copy is your ransomware insurance. Without it, attackers who compromise your cloud credentials can delete or encrypt every copy you have.

Can't I just use cloud snapshots as backups?

No. A snapshot is a point-in-time copy that often uses pointers, not a full physical copy. It's fast and cheap initially, but if the source data is unavailable, snapshots often become unusable (NIST SP 800-209). VMware is blunt: snapshots are not backups—they're change logs, and if the base disk is deleted, the snapshot alone can't restore a VM (Broadcom KB). Worse, snapshots grow over time. VMware recommends keeping no more than 2–3 snapshots and never retaining one longer than 72 hours (Broadcom KB). Use snapshots for short-term rollback, not as your disaster recovery plan.

What's the difference between RPO and RTO?

RPO is how much data you can afford to lose, measured in time. RTO is how fast you must be back online. They drive everything. Mission-critical systems often need an RTO under 1 hour and an RPO under 5 minutes (NIST). For a payment system, that means near-continuous backup. NIST SP 800-209 suggests snapshot intervals of 5 minutes or less if you can't lose more than 5 minutes of committed data. Your backup frequency must match your RPO—not your gut feeling.

Are incremental backups always better than full backups?

Not always. A full backup copies every file, giving you the most complete restore point but taking the most time and storage. Incremental backups copy only changes since the last backup of any type, so restoring requires the last full plus every incremental since. Differential backups copy all changes since the last full, so you only need the last full plus the most recent differential. The right mix depends on your RTO. If you need to restore in under an hour, a chain of 20 incrementals will blow your RTO. That's why NIST SP 800-209 recommends tiering: for example, 48 hourly snapshots or 30 daily backups, organized by data type (Tier 1, Tier 2).

Do I really need to test restores?

Yes. An untested backup is an assumption. High availability (HA) is not a substitute for backups—data corruption can propagate through an HA system, making recovery impossible without a separate backup (NIST SP 800-34). Test at least monthly for critical data, and for strict recovery speeds, do an end-to-end restore to a sandbox (NIST SP 800-209). Keep a recovery catalog of each copy and scan old backups with current anti-malware tools to catch poisoned copies. Ransomware has evolved to target backup appliances and NAS devices (NIST SP 800-209). If you never test, you won't know until it's too late.

What should I look for in a cloud backup service?

Look for immutability, encryption, and granular recovery. AWS Backup, for instance, stores backups in an encrypted vault and supports continuous backups for point-in-time restore within the last 35 days, plus periodic snapshots with retention up to 99 years (AWS Backup). That's a strong RPO story. But watch the cost: S3 Versioning must be enabled, and without a lifecycle expiration rule, storage costs can balloon as all versions are retained (AWS). Also, don't forget tape. LTO-9 offers up to 45 TB compressed per cartridge and provides an inherent air gap that disk lacks (LTO Program). For long-term retention, tape is still the cheapest air-gapped option.

• Key actions: Enable immutability on at least one copy. Set RPO/RTO per data tier. Test restores monthly. Keep an offline copy.

Bottom line: Cloud backup is not a set-and-forget product. It's a discipline. Start with the 3-2-1-1-0 rule, define your RPO and RTO for each system, and test your restores. If you can't restore it, you don't have a backup. And with ransomware complaints rising 9% in 2024 (FBI IC3), the stakes are too high to guess.

Sources

• CISA - https://www.cisa.gov/stopransomware
• NIST - https://csrc.nist.gov/glossary
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• Broadcom KB - https://knowledge.broadcom.com/external/article/318825/best-practices-for-using-vmware-snapshot.html
• AWS Backup - https://docs.aws.amazon.com/aws-backup/latest/devguide/s3-backups.html
• LTO Program - https://www.lto.org/newsbytes-september-2022/
• FBI IC3 2024 Internet Crime Report - https://www.ic3.gov/Media/PDF/AnnualReport/2024_IC3Report.pdf