Why Your Local Backup Is a Lie Without an Air Gap

The misconception that's leaving you exposed

Most people think a local backup—an external drive, a second NAS, even a RAID array—will save them when disaster strikes. That's wrong. A local backup is nothing more than a second copy of your data sitting in the same building, often connected to the same network. If ransomware hits, it will encrypt that backup too, along with the original. I've seen it happen to small businesses and home users alike. The 3-2-1 rule—three copies, two different media, one off-site—is a good start, but it's not enough anymore. The modernized 3-2-1-1-0 rule, endorsed by CISA, adds two crucial requirements: one immutable or air-gapped copy and zero unverified backups (CISA data backup guidance). If you're not following that, your local backup is a lie.

What does 'local' really mean in a ransomware world?

Local backup traditionally means data stored on a physically separate device in your vicinity—an external hard drive, a second internal disk, or a network-attached storage (NAS) box. The idea is that if your primary storage fails, you can restore from that nearby copy. That works for hardware failure, accidental deletion, or even a small fire. But ransomware doesn't care about your disk failure. NIST SP 800-209 warns that attackers target not only primary data but also backups and copies, and they may interfere with the backup process itself to gradually poison future copies (NIST SP 800-209). A local backup that's connected to the same network is a sitting duck. It's not a backup; it's a second target.

The immutable or air-gapped copy: your only real defense

So what does an immutable or air-gapped copy actually look like? Immutable means the data cannot be altered or deleted after it's written, as NIST SP 800-209 defines it (NIST SP 800-209). An air-gapped copy is physically or logically isolated from the network—no cables, no wireless, no remote access. The classic example is tape: LTO tape technology provides an inherent air gap, giving you confidence you can recover data even after an attack (LTO Program). But tape isn't the only option. You can also use cloud storage with object locking (like S3's versioning and AWS Backup's immutable vaults) or a dedicated backup appliance that supports immutability. The point is, your local backup must not be reachable by the same malware that hit your primary systems.

Why I recommend a hybrid approach: local speed, remote safety

I'm not saying abandon local backups. Local backups are fast to restore and convenient. But they should be just one leg of the stool. The 3-2-1-1-0 rule calls for three copies total, on two different media, with one off-site. The off-site copy can be an air-gapped tape in a safe deposit box or a cloud bucket with immutability. For most individuals and small businesses, I'd recommend a local NAS with versioning (so you can roll back to previous versions) plus an encrypted cloud backup with object lock. The cloud gives you the off-site and often immutable piece. You don't need a second local copy if you have the cloud. But whatever you do, test that restore—zero unverified backups is the final '0' in the rule, and CISA advises regularly testing your backups (CISA data backup guidance).

A concrete example: setting up a ransomware-resistant local backup

Let's say you run a small office with a file server and a NAS. You think you're safe because you back up the server to the NAS every night. But if ransomware hits the server, it can also hit the NAS if it's on the same network segment. Instead, configure the NAS to be a target for backups but not a live share—put it on a separate VLAN and use a backup application that writes to it in an immutable format. Then, once a week, take a tape backup or upload an encrypted snapshot to a cloud bucket with versioning. For a home user, it's simpler: use a cloud service like Backblaze or AWS Backup with S3 versioning. Remember, the first backup is full, subsequent ones are incremental (AWS Backup S3 backups Developer Guide). And if you're using AWS, be aware that S3 versioning must be enabled before AWS Backup can back up the bucket, and you should set a lifecycle rule to expire old versions to control storage costs (AWS S3 backup User Guide).

Quick tip: don't let your backup software become the attack vector

Backup software itself can be compromised. NIST SP 800-209 notes that ransomware has evolved to target storage components like NAS and backup appliances (NIST SP 800-209). So, ensure your backup management console is protected with multi-factor authentication and is not directly exposed to the internet. And never keep encryption keys with the data—store them separately.

What I'd actually do

Here's my personal recommendation: use a local backup for speed and a cloud backup for safety. For my own data, I use a local external SSD for nightly full backups (with file history) and a cloud service that offers immutable snapshots—like AWS Backup or a provider that supports object lock. I test a restore monthly, because NIST recommends testing critical data at least monthly (NIST SP 800-209). I also keep one tape cartridge in a bank safe deposit box, updated quarterly, because tape gives me that true air gap. It's not the cheapest or easiest, but it's the only way I can sleep at night knowing that even if my house burns down or ransomware encrypts everything, I can still recover. And that's what a backup is for.

Sources

• CISA data backup guidance - https://www.cisa.gov/stopransomware
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• AWS Backup S3 backups Developer Guide - https://docs.aws.amazon.com/aws-backup/latest/devguide/s3-backups.html
• AWS S3 backup User Guide - https://docs.aws.amazon.com/AmazonS3/latest/userguide/backup-for-s3.html
• LTO Program - https://www.lto.org/newsbytes-september-2022/