Snapshots Aren't Backups: Why You're One Ransomware Attack Away from Disaster

“Snapshots are backups” is wrong — here’s why it’s dangerous

I see it all the time: IT teams proudly tell me they have backups, and when I dig deeper, they’re running VMware snapshots or cloud volume snapshots and calling it a day. That’s a mistake. Snapshots are not backups. They’re point-in-time copies that often use pointers rather than full physical copies, which makes them fast and cheap, but they’re tied to the original storage. As NIST SP 800-209 puts it, if the source data is unavailable, the snapshots will often not be usable either (NIST SP 800-209). And Broadcom/VMware is blunt: a snapshot is only a change log of the original virtual disk, and if the base disks are deleted, the snapshot files alone are not sufficient to restore a virtual machine (Broadcom KB). So if ransomware encrypts your primary storage, your snapshots might go down with it.

That’s why I’m writing this. I want to dispel the myths that lead people to a false sense of security, and give you a concrete path to real backups that will survive an attack.

Isn’t a snapshot a backup?

No. A snapshot is a point-in-time copy that often uses pointers rather than a full physical copy, allowing it to be created quickly with low initial disk usage (Backup terminology). But that efficiency comes at a cost: it’s not independent of the original data. NIST SP 800-209 defines a snapshot as a storage-efficient form of point-in-time copy that stores only the individual portions of data changed from a given point in time, and notes that if the source data is unavailable, the snapshots will often not be usable either (NIST SP 800-209). That’s the opposite of a backup, which should be an independent copy you can restore from even if the primary system is gone.

Think about it: if your server’s disks are encrypted by ransomware, the snapshot that lives on the same storage array is probably encrypted too. You’re left with nothing. That’s not a backup; that’s a false sense of security.

What’s the 3-2-1 rule, and is it enough?

The classic 3-2-1 rule, coined by photographer Peter Krogh, calls for 3 copies of data, on 2 different storage media, with 1 copy off-site (CISA). That’s a solid baseline. But in the age of ransomware, it’s not enough. CISA now pushes a modernized 3-2-1-1-0 rule: add 1 immutable or air-gapped copy and 0 unverified backups (CISA). Immutability means data is locked after creation, preventing alteration or deletion (NIST SP 800-209). An air-gapped copy is physically or logically isolated from your network. And the “0” means you must actually test your backups, because an untested backup is an assumption (NIST).

So, yes, 3-2-1 is a good start, but if you want to survive ransomware, you need the extra “1” and the “0”.

What do RPO and RTO actually mean, and why should I care?

RPO (Recovery Point Objective) is the maximum acceptable data loss measured in time — the latest point to which data can be restored (NIST). RTO (Recovery Time Objective) is the maximum acceptable downtime before systems and business functions must be restored (NIST). In plain English: RPO is how much data you can afford to lose, and RTO is how fast you must be back online (NIST).

These numbers drive everything about your backup strategy. Mission-critical systems are often assigned an RTO under 1 hour and an RPO under 5 minutes (NIST). That’s a tall order. For less critical systems, you can relax. But you have to define them, because your backup software needs to know how often to run and how fast to restore.

Doesn’t high availability (HA) make backups unnecessary?

No. High availability is not a backup. HA is a process of redundancy and failover built into a system to achieve uptime of 99.999 percent or higher, equivalent to just a few minutes of downtime per year (NIST SP 800-34). But NIST explicitly warns that HA systems cannot replace a solid backup strategy because a corruption of data on a system may propagate through an HA system, making recovery impossible without a backup separate from the system itself (NIST SP 800-34).

Imagine a ransomware infection that encrypts your primary server and then replicates to your HA replica. Your HA system just spreads the poison. Without a separate, clean backup, you’re done.

How often should I test my backups?

Don’t wait for a disaster to find out your backups are corrupt. NIST SP 800-209 recommends that backups be periodically tested, at least monthly for critical data, to verify their integrity and ability to be restored (NIST SP 800-209). And for applications with strict restoration speed requirements, do an end-to-end test restore to a sandbox recovery environment (NIST SP 800-209). That’s not overkill; it’s the only way to know your backups work.

Quick tip: set a recurring calendar reminder for the first Monday of every month to test a different backup set. You’ll thank yourself later.

What about cloud backups — are they automatically safe?

Cloud backups can be great, but they’re not automatically safe. For example, AWS says that S3 Versioning must be activated on a bucket before AWS Backup can back it up, and without a lifecycle expiration rule, storage costs might increase as AWS Backup retains all versions (AWS S3 backup). That’s a cost trap. But more importantly, cloud backups can be configured with immutability, which is exactly what you want. AWS Backup supports continuous backups for point-in-time restore within the last 35 days, and periodic snapshot backups can be retained for up to 99 years (AWS Backup S3 backups). That’s powerful, but you have to set it up correctly.

And don’t forget that cloud backups are still vulnerable if your cloud account is compromised. The same NIST guidance about immutability applies: you need an immutable copy that even a compromised admin account can’t delete.

Is tape backup dead?

No, and in fact, tape is making a comeback for ransomware protection. The LTO Program points out that LTO tape provides an inherent air gap solution, because tape is offline and not connected to your network (LTO Program). That’s a huge advantage against ransomware. LTO-9 cartridges offer up to 45 TB compressed capacity (18 TB native), and the roadmap goes to LTO-14 with up to 1.44 PB per tape (LTO Program). Tape isn’t fast for recovery, but for long-term retention and an air-gapped copy, it’s unbeatable.

My advice: use tape for your immutable, air-gapped copy, and use disk or cloud for faster recovery. That’s the 3-2-1-1-0 in action.

What I’d actually do

Here’s my concrete, opinionated recommendation. First, define your RPO and RTO for each data tier. For mission-critical systems, aim for an RPO under 5 minutes and an RTO under 1 hour (NIST). That means continuous backup or frequent snapshots (like every 5 minutes) for those systems, but remember to store those snapshots on separate storage that isn’t directly accessible from the primary network.

Second, implement the 3-2-1-1-0 rule. Keep 3 copies of your data, on 2 different media types (say, SSD and tape), with 1 copy off-site (CISA). Add 1 immutable or air-gapped copy — I’d use tape for that, or an object lock-enabled cloud bucket. And make sure you have 0 unverified backups: test monthly, at least for critical data (NIST SP 800-209).

Third, use backup software that supports these strategies. Whether it’s AWS Backup for S3, or a traditional backup suite that can handle both disk and tape, make sure it can do incremental forever, and that it can create immutable copies.

Finally, remember that ransomware is the most pervasive threat to critical infrastructure, with complaints rising 9% in 2024 (FBI IC3). Don’t be a statistic. Build your backup strategy as if you’re already under attack.

Sources

• CISA - https://www.cisa.gov/stopransomware
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• NIST SP 800-34 Rev. 1 - https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
• Broadcom KB - https://knowledge.broadcom.com/external/article/318825/best-practices-for-using-vmware-snapshot.html
• FBI IC3 2024 Internet Crime Report - https://www.ic3.gov/Media/PDF/AnnualReport/2024_IC3Report.pdf
• LTO Program - https://www.lto.org/newsbytes-september-2022/