Cloud Backup Is Not Enough: Why You Need an Immutable Copy

The 3-2-1 Rule Has a Hole

In 2024, ransomware complaints to the FBI's IC3 rose 9 percent from the previous year, and the agency called it the most pervasive threat to critical infrastructure (FBI IC3 2024 Internet Crime Report). Yet many of us still treat cloud backup as a silver bullet, assuming that because our data is in Amazon S3 or Azure Blob, we're safe. We're not. The classic 3-2-1 rule—three copies, two media, one off-site—has a gaping hole: it doesn't account for ransomware that sits dormant in your environment and encrypts your backups along with your production data. That's why the modernized 3-2-1-1-0 rule, which adds one immutable or air-gapped copy and zero unverified backups, should be your new baseline (CISA).

Why Cloud Backups Alone Fail

Cloud storage is convenient, but it's not inherently immune. NIST SP 800-209 warns that attackers target not only primary data but also backups and copies, and they may interfere with the backup process itself to gradually poison future copies (NIST SP 800-209). In practice, this means an attacker who gains credentials to your AWS account can delete your S3 buckets or overwrite versions. Even if you use snapshots, they're not a silver bullet: a snapshot is a storage-efficient point-in-time copy, but as NIST notes, if the source data is unavailable, the snapshots will often not be usable either. That's because many snapshot implementations depend on the underlying storage. And in the VMware world, Broadcom is explicit: snapshots are not backups—they're just change logs of the original virtual disk, and if the base disks are deleted, the snapshots alone can't restore a VM (Broadcom KB). So while cloud snapshots are great for quick rollbacks, they shouldn't be your only line of defense.

Consider the math: if you're using AWS Backup for S3, the first backup is full, but subsequent ones are incremental at the object level (AWS Backup). That's efficient, but it means a single corrupted version could potentially be restored, and you need versioning enabled. AWS recommends setting a lifecycle expiration rule to avoid cost bloat, but that also means older versions get deleted. If ransomware deletes your current version and the lifecycle has already purged the older ones, you're stuck. The answer isn't to abandon cloud—it's to add an immutable copy.

Immutability and Air Gaps Are Non-Negotiable

Immutability is the property that locks data after creation, preventing alteration or deletion (NIST SP 800-209). In practice, this means a backup that even the backup admin can't modify for a set period. Cloud providers offer object lock features, but you have to configure them correctly. And for true air-gapped protection, consider tape. The LTO Program points out that tape provides an inherent air gap—it's offline, so ransomware can't reach it. LTO-9 cartridges hold up to 45 TB compressed, and the roadmap shows capacities doubling each generation, with LTO-14 hitting 1.44 PB per cartridge (LTO Program). Tape isn't sexy, but it's cheap and reliable for long-term retention. For most organizations, a hybrid approach works best: keep cloud for operational recovery, but write an immutable copy to a separate cloud bucket or to tape for ransomware-proofing.

Test Your Backups or You Don't Have Backups

The '0' in 3-2-1-1-0 stands for zero unverified backups. An untested backup is an assumption, as NIST contingency planning puts it. NIST SP 800-209 recommends testing critical backups at least monthly and performing end-to-end test restores to a sandbox for applications with strict recovery time requirements (NIST SP 800-209). This isn't just a nice-to-have. CISA's ransomware response checklist insists you restore from offline, encrypted backups during recovery, but if you've never tested that process, you're flying blind. I've seen teams confidently point to their cloud snapshots, only to discover during a drill that they can't restore because the IAM roles were misconfigured or the snapshots were encrypted with a key that's been rotated. Regular testing catches those issues before a real incident.

Some practitioners argue that continuous data protection (CDP) or high availability eliminates the need for backups. That's wrong. NIST SP 800-34 explains that high availability systems can propagate corruption across replicas, making recovery impossible without a backup separate from the system (NIST SP 800-34). CDP journals changed blocks, but if the journal gets encrypted too, you're done. So don't be lulled by replication. The counter-argument is that immutable cloud backups are enough, and maybe for some, but the threat landscape is evolving. The FBI's 2024 report notes that reported ransomware losses are artificially low because they don't include lost business or remediation costs, and the true impact is far higher (FBI IC3 2024 Internet Crime Report). We can't afford to be complacent.

Takeaway

Cloud backup is a critical component, but it's not sufficient. Adopt the 3-2-1-1-0 rule: keep three copies, on two media, one off-site, and add at least one immutable or air-gapped copy. Test your restores regularly—monthly for critical data. And remember, snapshots are not backups. If you don't have an immutable copy, you're one ransomware attack away from losing everything. Make the change today.

Sources

• CISA - https://www.cisa.gov/stopransomware
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• NIST SP 800-34 Rev. 1 - https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
• FBI IC3 2024 - https://www.ic3.gov/Media/PDF/AnnualReport/2024_IC3Report.pdf
• AWS Backup - https://docs.aws.amazon.com/aws-backup/latest/devguide/s3-backups.html
• LTO Program - https://www.lto.org/newsbytes-september-2022/