Local Backup Isn't Dead—It's Your Last Line of Defense

What's the Real State of Local Backup in 2024?

Ransomware complaints rose 9 percent from 2023, and the FBI's IC3 received 2,705 ransomware complaints in 2024 with adjusted losses topping $12.4 million (FBI IC3 2024 Internet Crime Report). But that number is misleading—it doesn't count lost business, time, or the cost of restoring systems. The real threat isn't just the ransom; it's the downtime and data loss. That's why local backup isn't a legacy afterthought. It's your last line of defense when the network goes dark and the cloud sync starts deleting your files.

Local backup means copies of your data stored on premises—on external drives, NAS devices, or even tape. It's not glamorous, but it's the only copy you control completely. The cloud is great, but if you're relying solely on synced folders, a ransomware attack that encrypts your local files will also encrypt the synced versions. You need a local backup that isn't connected to the network, or at least one that's immutable and tested.

The 3-2-1 rule is still the baseline: three copies of your data, on two different media, with one off-site (CISA). But that rule was written before ransomware became the pervasive threat it is today. CISA now pushes a modernized 3-2-1-1-0: add one immutable or air-gapped copy, and zero unverified backups. That means you need a local backup that can't be encrypted or deleted by an attacker, and you need to prove it works.

Why Local Backups Fail—and How to Fix Them

Most local backup failures aren't hardware failures. They're design failures. You plug in an external drive, set up a nightly backup, and forget about it. Then, when disaster strikes, you discover the drive was corrupted, the backup didn't run, or—worse—the ransomware encrypted the backup drive too because it was always connected.

NIST SP 800-209 points out that attackers don't just target your primary data; they target your backups and may try to poison future copies gradually. If your backup process is always-on and writable, it's vulnerable. The fix is to make your local backup immutable or air-gapped. Immutability means data is locked after it's written—no one can alter or delete it, not even an admin with root access (NIST SP 800-209). Air-gapped means physically or logically disconnected from the network, so it's unreachable by an attacker.

Here's a concrete example: You run a small law firm with 2 TB of client files. You back up nightly to a NAS that's always on. A ransomware attack encrypts your main server and the NAS, because the NAS is mounted as a network drive. You have no clean copy. If, instead, you had a dedicated external drive that you connect only for the backup window, then disconnect and store in a fireproof safe, that drive is air-gapped. It's not a perfect solution—you have to remember to do it—but it's a cheap, effective way to get an offline copy.

For better protection, use a backup appliance that supports immutability, or write to tape. LTO tape is inherently offline—it's not mounted until you put it in a drive (LTO Program). That's why tape is still a solid choice for ransomware defense, even if it's slower to restore.

RPO and RTO: The Metrics That Drive Your Local Backup Strategy

You can't design a backup strategy without knowing your Recovery Point Objective (RPO) and Recovery Time Objective (RTO). RPO is the maximum acceptable data loss measured in time—the point in time to which you must recover (NIST). RTO is the maximum downtime you can tolerate before systems must be back. These aren't just IT jargon; they're the numbers that determine how often you back up and how fast you can restore.

For critical systems, NIST suggests an RTO under 1 hour and an RPO under 5 minutes (NIST). That's aggressive. A nightly backup won't cut it if you can't afford to lose more than 5 minutes of transactions. You'd need continuous data protection (CDP) or snapshots taken every 5 minutes or less (NIST SP 800-209). But for less critical data, a nightly backup might be fine.

Here's the trap: Many people think snapshots are backups. They're not. VMware is blunt: a snapshot is only a change log of the original virtual disk (Broadcom KB). If the base disk is deleted, the snapshot alone can't restore the VM. Snapshots are great for quick rollbacks, but they're not a backup. NIST SP 800-209 echoes that: if the source data is unavailable, snapshots are often unusable. So, don't rely solely on snapshots for your local backup.

Instead, use a tiered approach. For each data tier, define your RPO/RTO and then pick the backup method that meets it. For example, for a database that must lose no more than 5 minutes of data, you might use transaction log shipping (a form of continuous backup) plus a nightly full backup. For less critical files, nightly incremental backups might suffice. The key is to document this plan and review it regularly—at least annually, as NIST recommends (NIST SP 800-209).

Testing: The Difference Between a Backup and a Hope

An untested backup is an assumption, not a plan. That's not just a saying; it's a hard truth. CISA says to regularly test backups (CISA). NIST SP 800-209 goes further: test backups at least monthly for critical data, and do an end-to-end test restore to a sandbox environment if you have strict restoration speed requirements. This isn't optional—it's the only way to know your backups actually work.

Testing also helps you find problems you didn't know you had. Maybe your backup software has been failing for weeks, but you never noticed because the logs were ignored. Or maybe your backup media is corrupt because it's been sitting in a hot closet. Testing catches those issues before you need them.

Consider a real scenario: A mid-sized accounting firm has a local backup server with nightly full backups. They've never tested a restore. One day, a ransomware attack encrypts their servers. They wipe and rebuild, then try to restore from backup. The restore fails because the backup software had a bug that truncated files over 4 GB. They lose a week of work and have to pay a negotiator. If they had tested monthly, they'd have discovered the bug long before.

Testing doesn't have to be elaborate. At minimum, do a test restore of a few critical files each month. For critical systems, do a full test restore to a sandbox environment. And don't forget to scan your backups for malware—NIST suggests periodically scanning past copies with current anti-malware tools (NIST SP 800-209). You don't want to restore a poisoned backup.

Local Backup Isn't Dead—It's Your Last Line of Defense

Some experts say local backup is obsolete, that the cloud is enough. They're wrong. Cloud backups can be a target too, and they're not always under your control. Local backup gives you a copy that you physically own and can access even if your internet connection is down or your cloud provider is compromised. The key is to make it secure: use encryption, keep it offline or immutable, and test it regularly.

Here's my recommendation: Follow the 3-2-1-1-0 rule (CISA). Keep three copies of your data, on two different media, with one off-site. Add one immutable or air-gapped copy, and zero unverified backups. That means you might have a local NAS for fast recovery, a local external drive that's air-gapped for ransomware defense, and a cloud backup for off-site protection. It's not cheap, but it's cheaper than paying a ransom or losing your business.

Don't forget the physical layer. Store your air-gapped drive in a fireproof safe or a separate building. NIST even suggests using a separate facility or a fire-rated container for critical backups (NIST SP 800-53). And if you use tape, store it off-site in a secure vault. The LTO Program notes that tape provides an inherent air gap, giving you confidence you can recover after an attack (LTO Program).

Finally, don't neglect the human factor. Backups fail because people forget to connect the drive, or they use the same password for the backup server, or they skip the monthly test. Make testing a habit. Write it into your calendar. Assign someone to own it. The cost of a test is nothing compared to the cost of losing everything.

Sources

• CISA - https://www.cisa.gov/stopransomware
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• FBI IC3 2024 Internet Crime Report - https://www.ic3.gov/Media/PDF/AnnualReport/2024_IC3Report.pdf
• Broadcom KB - https://knowledge.broadcom.com/external/article/318825/best-practices-for-using-vmware-snapshot.html
• LTO Program - https://www.lto.org/newsbytes-september-2022/