Snapshots vs. Backups: Why Your Recovery Plan Is Probably Broken

The Misconception: Snapshots Are Backups

We've all heard it: "We have snapshots, so we're covered." It's a dangerous myth that persists in IT departments everywhere. The truth is, snapshots are not backups. They're a point-in-time copy that often uses pointers rather than a full physical copy, allowing them to be created quickly with low initial disk usage. But as NIST SP 800-209 notes, if the source data is unavailable, the snapshots will often not be usable either. That's a critical flaw when you're facing ransomware or a corrupted database.

In the field, we see this misconception lead to disaster. A team relies on VMware snapshots for recovery, only to discover that the base disks are gone or corrupted. Broadcom/VMware is crystal clear: VMware snapshots are not backups. A snapshot file is only a change log of the original virtual disk, creating a delta disk that stores changes made since the snapshot. If the base disks are deleted, the snapshot files alone are not sufficient to restore a virtual machine. This is a hard lesson we'd rather not learn the hard way.

So, what does a proper backup look like? It's not just about having copies; it's about having copies that can actually be restored, and that are protected from the very threats you're trying to recover from. Let's break down the real options.

Criteria: RPO, RTO, and Ransomware Resistance

When we evaluate recovery solutions, we look at three concrete criteria: Recovery Point Objective (RPO), Recovery Time Objective (RTO), and how well the solution stands up to ransomware. RPO is the maximum acceptable data loss measured in time—the latest point to which data can be restored. RTO is the maximum acceptable downtime before systems and business functions must be restored. (NIST)

For mission-critical systems, we often need an RTO under 1 hour and an RPO under 5 minutes (NIST). That's tight. Ransomware resistance means having an immutable or air-gapped copy, as CISA's 3-2-1-1-0 rule suggests: 3 copies of data, on 2 different media, 1 off-site, plus 1 immutable or air-gapped copy, and 0 unverified backups. (CISA) Immutability locks data after creation, preventing alteration or deletion—a key defense against ransomware that tries to encrypt your backups too.

With those criteria in mind, let's compare three common approaches: snapshots (as a primary strategy), cloud backups (specifically AWS Backup for S3), and tape (specifically LTO-9).

Option 1: Snapshots – Fast but Fragile

Snapshots are seductive because they're fast and cheap. Amazon RDS automated backups, for instance, create a storage volume snapshot of the entire DB instance. The first snapshot is a full copy, and subsequent ones are incremental, saving only changed data. That's great for quick restores within a cloud environment. But here's the rub: snapshots are often stored on the same infrastructure as the source. If that infrastructure is compromised, your snapshots are toast. NIST SP 800-209 warns that snapshots are not a substitute for backups; they're a storage-efficient form of point-in-time copy, but if the source is unavailable, the snapshots often are too.

In the VMware world, snapshots are even riskier. Broadcom/VMware recommends using only 2 to 3 snapshots in a chain, and never retaining a single snapshot for more than 72 hours, because the snapshot file grows and can fill your storage, impacting performance. A snapshot is not a backup; it's a change log. So, for any long-term recovery, you need real backups.

Who is this for? Snapshots are great for short-term, operational recovery—like rolling back a bad deployment or a quick restore of a single file. But they are not your disaster recovery plan.

Option 2: Cloud Backups – Scalable but Not Air-Gapped

Cloud backups, like AWS Backup for S3, offer scalability and flexibility. AWS Backup is a fully managed, policy-based service that automates backups and stores them in an encrypted backup vault. You can have continuous backups for point-in-time restore within the last 35 days, or periodic snapshot backups that can be retained for up to 99 years. (AWS) That's impressive. The first backup is full, and subsequent ones are incremental at the object level, so it's efficient.

But is it ransomware-proof? Not entirely. While the backup vault is encrypted, it's still in the same cloud account. If an attacker gains access to your AWS credentials, they could delete your backups. CISA's updated #StopRansomware Guide specifically added guidance addressing cloud security backups, highlighting that you need to protect those too. The LTO Program makes a pointed observation: disk storage offers faster recovery times, but it is not offline and is not completely secured from ransomware attacks.

Cloud backups are excellent for meeting RPO/RTO with minimal operational overhead, especially for dynamic workloads. But for the ultimate protection, you need an air gap.

Option 3: Tape – The Air Gap Champion

Tape might seem old-school, but it's making a comeback for a reason. LTO-9 offers up to 45 TB compressed capacity per cartridge, with hardware-based encryption, WORM (Write-Once, Read-Many) functionality, and the Linear Tape File System (LTFS). (LTO) The key advantage is the inherent air gap: tape is offline, so ransomware can't reach it. That's why CISA recommends maintaining offline, encrypted backups of data. (CISA)

Tape's RTO is slower—you need to physically retrieve a tape and load it into a drive. But for many organizations, the trade-off is worth it for the security. NIST SP 800-34 describes cold sites as the least expensive to maintain but requiring substantial time to acquire and install equipment; tape is similar—low cost per GB, but slower recovery. However, for compliance and long-term archival, tape is unbeatable.

Who is this for? Organizations that need to retain data for years, have strict compliance requirements, or want a true air gap against ransomware. It's not for every workload, but it's a critical part of a layered strategy.

Comparison Table

The Verdict: Use All Three, but Tape Is the Insurance

Here's the thing: you don't have to choose. A solid backup strategy uses snapshots for fast recovery, cloud backups for off-site redundancy, and tape for the final air-gapped, immutable copy. CISA's 3-2-1-1-0 rule is a good guide. But if we have to prioritize, tape is the only one that truly protects against ransomware. As the LTO Program notes, tape provides an inherent air gap that gives confidence you can recover data in the event of an attack.

Quick tip: Whatever you use, test your restores regularly. NIST SP 800-209 recommends testing backups at least monthly for critical data, and performing end-to-end test restores for applications with strict speed requirements. An untested backup is an assumption, not a plan.

Sources

• CISA – https://www.cisa.gov/stopransomware
• NIST SP 800-209 – https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• Broadcom KB – https://knowledge.broadcom.com/external/article/318825
• AWS Backup – https://docs.aws.amazon.com/aws-backup/latest/devguide/s3-backups.html
• LTO Program – https://www.lto.org/newsbytes-september-2022/