Cloud Backup Isn't Off-Site: Why You Need an Air Gap

The 3-2-1 Rule Is Not Enough Anymore

In 2024, the FBI's IC3 received 2,705 ransomware complaints, with reported losses of over $12.4 million (FBI IC3 2024 Internet Crime Report). But that number is artificially low—it excludes lost business, time, wages, and the cost of third-party remediation. The real toll is far higher. And as ransomware evolves, your cloud backup strategy must evolve with it. The old 3-2-1 rule—three copies, two media, one off-site—is a good baseline, but it's no longer sufficient. We need to adopt the 3-2-1-1-0 rule: three copies, two different media, one copy off-site, one copy immutable or air-gapped, and zero unverified backups (CISA).

Cloud Backups Are Not Automatically Safe

We hear it all the time: "We're in the cloud, so we're safe." That's a dangerous assumption. Cloud backups are still accessible via the network, and ransomware can propagate to them if they're not properly isolated. NIST SP 800-209 warns that attackers target not only primary data but also backups and copies, and they may interfere with the backup process itself to gradually poison future copies (NIST SP 800-209). If your cloud backup is just a bucket with versioning, and an attacker gets your credentials, they can encrypt or delete those versions. The cloud is not an air gap—it's just another location.

The Air Gap or Immutable Copy Is Your Insurance

The 3-2-1-1-0 rule addresses this head-on. The fourth "1" is an immutable or air-gapped copy. Immutability, as defined by NIST, locks data after creation, preventing alteration or deletion (NIST SP 800-209). That means even if an attacker compromises your cloud account, they can't modify or delete that copy. How do you achieve this in the cloud? Some providers offer object lock or WORM (Write-Once, Read-Many) storage. Or you can go old-school with tape: LTO tape provides an inherent air gap—it's offline when it's sitting on a shelf (LTO Program). Tape isn't dead; it's a ransomware-proof insurance policy.

But What About Recovery Speed?

The strongest counter-argument is that tape or air-gapped copies are slow to restore. True, disk-based recovery is faster. But NIST SP 800-34 points out that high availability (HA) is not a substitute for backups—data corruption can propagate through HA systems, making recovery impossible without a separate backup (NIST SP 800-34). And for most organizations, the RTO (Recovery Time Objective) for critical systems is under an hour, while less critical systems can tolerate longer downtime (NIST). The key is tiering: you don't need to restore everything from tape. Keep a recent, fast-recoverable backup in the cloud (maybe a snapshot), but also maintain an immutable or air-gapped copy for the worst-case scenario. The air-gapped copy is your last line of defense, not your primary recovery path.

Testing: The Zero in 3-2-1-1-0

The "0" in 3-2-1-1-0 means zero unverified backups. CISA advises maintaining offline, encrypted backups and regularly testing them (CISA). NIST SP 800-209 recommends testing backups at least monthly for critical data, and performing end-to-end test restores for applications with strict restoration speed requirements (NIST SP 800-209). We've seen too many organizations assume their backups work, only to discover during an incident that the backup is corrupt or incomplete. Test your restores. Automate them if you can. And keep a recovery catalog that records each copy and the results of anti-malware scans (NIST SP 800-209).

Quick Tip: Don't Keep Snapshots Too Long

One warning: VMware snapshots are not backups—they're change logs, and keeping one for more than 72 hours can fill your storage and impact performance (Broadcom). Use snapshots for short-term recovery, but don't rely on them as your backup.

Bottom Line

The single best move you can make is to implement the 3-2-1-1-0 rule: add an immutable or air-gapped copy to your existing 3-2-1 strategy, and verify your backups with regular tests. Cloud backup is convenient, but it's not inherently safe. The air gap is your insurance against ransomware.

Sources

• CISA - https://www.cisa.gov/stopransomware
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• NIST SP 800-34 - https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
• FBI IC3 2024 Internet Crime Report - https://www.ic3.gov/Media/PDF/AnnualReport/2024_IC3Report.pdf
• LTO Program - https://www.lto.org/newsbytes-september-2022/
• Broadcom - https://knowledge.broadcom.com/external/article/318825/best-practices-for-using-vmware-snapshot.html