The Backup Software Myth: Why Your Backups Are Doomed Without an Air Gap

The Myth of the Safe Backup

You've heard it a hundred times: "Make sure you have backups." And you dutifully set up your NAS, your cloud sync, maybe even a tape drive. But here's the contrarian truth: most backup software is a house of cards waiting to collapse under ransomware. The very tools you trust to save you are now prime targets for attackers. The FBI's 2024 IC3 report shows ransomware complaints rose 9% from 2023, and ransomware is now the most pervasive threat to critical infrastructure (FBI IC3 2024 Internet Crime Report). Attackers don't just encrypt your primary data anymore—they go after your backups too. NIST SP 800-209 warns that attackers target not only primary data assets but also their backups and copies, and may interfere with the backup process itself to gradually poison future copies (NIST SP 800-209). So if your backup software is just a mirrored copy of your live data, you're not protected—you're just providing a second meal for the ransomware.

The 3-2-1 Rule Is Not Enough

You've probably heard of the 3-2-1 rule: three copies of data, on two different media, with one copy off-site (CISA). It's a good baseline, but in 2025 it's dangerously incomplete. The modernized 3-2-1-1-0 rule adds two critical upgrades: one immutable or air-gapped copy, and zero unverified backups (CISA). An immutable copy can't be altered or deleted—it's locked after creation (NIST SP 800-209). An air-gapped copy is physically or logically isolated from your network, so ransomware can't reach it. The "0" means you verify your backups regularly, because an untested backup is just an assumption (NIST).

So what does this mean for your backup software choice? You need software that supports immutable storage, either on object lock in the cloud or on WORM tape. You need software that can create a true offline copy, not just a hot replica. And you need software that automates testing, because you won't remember to do it manually.

Option 1: Veeam Backup & Replication

Veeam is a heavyweight in the backup world. It supports full, incremental, and differential backups (standard backup terminology), and it can back up to a wide range of targets, including cloud object storage with object lock. It's particularly strong in virtualized environments—it can use VMware snapshots for quick, space-efficient point-in-time copies. But here's the catch: VMware snapshots are not backups. Broadcom/VMware states that a snapshot is only a change log of the original virtual disk, and if the base disks are deleted, the snapshot files alone are not sufficient to restore a VM (Broadcom KB). Veeam knows this, and it uses snapshots as a source for real backups, but you need to configure it correctly. If you rely on snapshots alone, you're in trouble. NIST SP 800-209 warns that snapshots often become unusable if the source data is unavailable (NIST SP 800-209). So Veeam is powerful, but it's only as good as your configuration.

Option 2: AWS Backup (with S3 Object Lock)

AWS Backup is a fully managed, policy-based service that natively integrates with Amazon S3. It supports continuous backups for point-in-time restore within the last 35 days, and periodic snapshot backups with retention up to 99 years (AWS Backup). The first backup of a bucket is full, subsequent ones are incremental at object level (AWS Backup). You can set lifecycle expiration rules to control costs (AWS S3 backup). For ransomware protection, you can enable S3 Object Lock, which makes backups immutable. AWS reports that for buckets with more than 300 million objects, the backup rate can reach up to 17,000 objects per second during initial full backup, which is impressive for large datasets (AWS Backup). But there's a catch: you must activate S3 Versioning before AWS Backup can back up a bucket, and without a lifecycle expiration rule, storage costs can balloon (AWS S3 backup). Also, cloud backups are not air-gapped unless you use a separate account or vault with strict IAM policies. If an attacker compromises your AWS credentials, they could potentially delete your backups—unless Object Lock is set to "Compliance" mode, which prevents even the root user from deleting.

Option 3: Tape (LTO Ultrium) with WORM

Tape is often dismissed as outdated, but it's the ultimate air gap. LTO Ultrium generation 9 offers up to 45 TB compressed capacity (18 TB native), supports hardware-based encryption, WORM functionality, and the Linear Tape File System (LTFS) (LTO Program). Tape provides an inherent air gap—it's offline when not in a drive, so ransomware can't touch it (LTO Program). The LTO roadmap shows capacities doubling with each generation, with LTO-14 delivering up to 1.44 PB per tape (LTO Program). But tape has a major downside: recovery time. Disk-based backups can restore in minutes, but tape requires physical handling and sequential reads, making it slow for large restores. So tape is best for long-term retention and disaster recovery, not for rapid recovery.

Head-to-Head Comparison

RPO and RTO are critical. NIST defines RPO as the maximum acceptable data loss, and RTO as the maximum acceptable downtime (NIST). For mission-critical systems, RTO under 1 hour and RPO under 5 minutes are common (NIST). Veeam and AWS can achieve that with continuous backups, but tape cannot. However, for ransomware protection, tape's air gap is unbeatable. So the choice depends on your priorities.

Who Should Use Which

• Veeam is for organizations with virtualized environments that need granular recovery and fast RTOs, especially if you have VMware or Hyper-V.
• AWS Backup is for cloud-native workloads already on AWS, where you can leverage object lock and pay-as-you-go.
• Tape is for organizations that need long-term archival and a true air gap for disaster recovery, and can tolerate slower RTOs.

But here's the blunt truth: you shouldn't pick just one. The best strategy is a tiered approach. Use Veeam or AWS for fast recovery (RPO of minutes, RTO of hours), and use tape for the "1" in the 3-2-1 rule—the offline, immutable copy that survives even if your primary and secondary copies are encrypted. NIST SP 800-209 recommends tiering and specifying frequency and number of copies for each tier (NIST SP 800-209). For example, keep 48 hourly snapshots for recent recovery, 30 daily backups for a month, and quarterly tape archives for long-term retention.

Also, remember that testing is non-negotiable. NIST SP 800-209 recommends testing backups at least monthly for critical data (NIST SP 800-209). And CISA emphasizes regularly testing backups as a key defense against ransomware (CISA). So whatever software you choose, schedule automated test restores and document the results.

The Final Word

The most important thing to remember: Your backup software is only as good as its weakest link, and if that link is a snapshot or a live mirror, ransomware will find it. Stop trusting snapshots as backups—they're not. Start using immutable, air-gapped copies for your critical data, and test them regularly. That's the difference between being a victim and being a survivor.

Sources

• CISA - Stop Ransomware
• NIST SP 800-34 Rev. 1
• NIST SP 800-209
• FBI IC3 2024 Internet Crime Report
• LTO Program - NewsBytes September 2022
• Broadcom KB - VMware Snapshot Best Practices