Local Backups Are Not Dead: Make Them Your First Line of Defense

Imagine you're at your desk on a Tuesday morning, and a ransomware pop-up freezes your screen. Your files are encrypted, and the clock is ticking. You reach for your backup—but the only copy you have is in the cloud, and the restore is going to take hours, maybe days, because your internet pipe is clogged with the rest of your office. Meanwhile, your boss is asking when you'll be back online. This is the moment when local backups prove their worth.

I'm going to say something that might sound heretical in the age of cloud-everything: local backups are not dead, and for many organizations, they should be your first line of defense. The cloud is a fantastic off-site copy, but it has weaknesses—speed, cost, and the risk of a compromised cloud account. A local backup, properly designed, gives you fast recovery, full control, and a true air gap that ransomware can't cross. Here's how to build one that actually works.

Why Local? Because Recovery Speed Matters

Your Recovery Time Objective (RTO) is the maximum acceptable downtime before your systems must be back (NIST). If your RTO is 2 hours, and your cloud restore takes 6, you've already lost. Local backups, stored on a NAS or external drive, can restore at disk speed, not internet speed. NIST SP 800-209 recommends that applications with strict restoration speed requirements perform an end-to-end test restore to a sandbox recovery environment (NIST SP 800-209). That test will reveal the brutal truth: cloud restores are slow. A local copy lets you meet an RTO of minutes, not hours.

Don't get me wrong—you need an off-site copy. But the 3-2-1 rule says you should have three copies, on two different media, with one off-site (CISA). That off-site copy can be cloud, but your primary recovery copy should be local, because it's fast and always available.

The Air Gap: Your Secret Weapon Against Ransomware

Ransomware is the most pervasive threat to critical infrastructure, with complaints rising 9 percent from 2023 (FBI IC3 2024). Attackers are sophisticated—they don't just encrypt your primary data; they target your backups too (NIST SP 800-209). That's why the modernized 3-2-1-1-0 rule adds one immutable or air-gapped copy and zero unverified backups (CISA). An air-gapped local backup—a drive that's physically disconnected from your network when not in use—is the gold standard. The LTO Program notes that tape provides an inherent air gap, giving you confidence you can recover after an attack (LTO Program). But even a USB drive that you unplug after each backup can serve that role.

Cloud backups are not air-gapped. If a ransomware attacker compromises your cloud credentials, they can delete or encrypt your backups too. Amazon S3 Versioning, for example, must be enabled before AWS Backup can back it up, and without lifecycle rules, costs can balloon (AWS S3). But even with versioning, if an attacker gains access to your account, they can delete versions. A local, offline copy is immune to that attack vector.

Snapshots Are Not Backups—Stop Treating Them Like They Are

Here's a trap many fall into: you rely on snapshots from your hypervisor or storage array as your backup. Snapshots are point-in-time copies that store only changed blocks, and if the source data is unavailable, the snapshots are often not usable either (NIST SP 800-209). VMware is blunt: snapshots are not backups; they're just change logs, and if the base disks are deleted, the snapshot files alone can't restore a VM (Broadcom). Plus, snapshots eat storage—Broadcom recommends not keeping a single snapshot for more than 72 hours, and using only 2 to 3 in a chain (Broadcom). Snapshots are great for quick rollbacks, but they live on the same system as your data. A ransomware attack that targets your storage array will take out your snapshots too. You need a real backup—a separate copy on separate media.

Build a Tiered Local Strategy

Not all data is equally critical. NIST SP 800-209 advises organizing your data protection plan by tier, specifying backup frequency and copy counts for each tier (NIST SP 800-209). For Tier 1—like your customer database—you might want an RPO of 5 minutes and an RTO under 1 hour (NIST). That means continuous backup, such as log shipping or CDP, to a local server. For Tier 2—like employee timesheets—a nightly incremental backup might suffice. And for Tier 3—old project files—a weekly full backup to an external drive is fine. The key is to write down your tiers and match your backup schedule to them, not to treat everything the same.

A concrete example: your finance team's QuickBooks file is Tier 1. You set up a local backup agent to take a snapshot every 15 minutes to a local NAS. Your RPO is 15 minutes. Your RTO? You can restore from that NAS in 30 minutes. Contrast that with your marketing assets—Tier 3. You back them up weekly to a USB drive. If you lose a day of marketing files, it's annoying but not catastrophic. That's tiering in action.

Test, Test, Test—or You Don't Have a Backup

An untested backup is an assumption. NIST SP 800-209 recommends testing backups at least monthly for critical data, and doing an end-to-end test restore for applications with strict speed requirements (NIST SP 800-209). Yet most organizations never test. They assume the backup software is working, until the day they need it and find the backup is corrupt. The 0 in 3-2-1-1-0 stands for zero unverified backups (CISA). So schedule a monthly restore drill. Pick a random file, restore it, and verify it opens. Once a quarter, restore an entire server to a test VM. It's tedious, but it's the only way to know your recovery will work.

You might argue: "But we have high availability—we have a redundant server in another rack." High availability is not a substitute for backups. NIST SP 800-34 notes that HA systems can't replace a solid backup strategy because a data corruption can propagate through the HA system, making recovery impossible without a separate backup (NIST SP 800-34). So HA is nice, but it doesn't save you from ransomware or a bad software update that corrupts your database on both servers.

Get Offline: The Cost-Effective Insurance

Local backups don't have to be expensive. A simple external USB drive can hold a full backup of your critical files. A NAS with RAID gives you more capacity and protection. But the best insurance is an offline copy. Consider tape: LTO-9 offers 18 TB native capacity per cartridge, with a roadmap to 1.44 PB per tape by LTO-14 (LTO Program). Tape is cheap per GB, and because it's removable, it's naturally air-gapped. But even a disk-based external drive that you unplug and store in a fireproof safe works. The key is that it's not connected to your network when not in use.

Some will say, "But cloud is easier—I don't have to manage hardware." True. Cloud is a great off-site copy. But for local, fast recovery, you need something on-premises. The best strategy is a hybrid: local backups for speed and air gap, plus cloud or another off-site location for disaster recovery. And when you do use cloud, remember to enable versioning and set lifecycle policies to control costs (AWS S3).

The Bottom Line

Your backup strategy is not complete without a local component. Ransomware is not going away—it's the most pervasive cyber threat, with reported losses of $12.5 million in 2024 alone (FBI IC3 2024). And the FBI cautions that those numbers are artificially low because they don't include business interruption costs (FBI IC3 2024). You need a backup that is fast to restore, immune to remote attacks, and tested. That means local, air-gapped, and verified.

So, start today: buy a USB drive, enable versioning on your NAS, or schedule a tape backup. And then test a restore. Because when ransomware hits, your local backup might be the only thing standing between you and a very bad week.

Sources

• CISA - https://www.cisa.gov/stopransomware
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• NIST SP 800-34 - https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
• Broadcom (VMware snapshots) - https://knowledge.broadcom.com/external/article/318825/best-practices-for-using-vmware-snapshot.html
• FBI IC3 2024 Report - https://www.ic3.gov/Media/PDF/AnnualReport/2024_IC3Report.pdf
• LTO Program - https://www.lto.org/newsbytes-september-2022/