Your External Drive Isn't a Backup. Here's What Actually Works Against Ransomware

The Misconception: Local Backup Is Safe Because It's Offline

You've got an external hard drive sitting in a drawer. You think it's your safety net. But if it's plugged into your computer when ransomware strikes, that drive is just another victim. Encrypted, locked, gone. And if you keep it unplugged, you're gambling on remembering to attach it regularly—and on the drive not failing when you finally need it. The 3-2-1 rule—three copies, two media, one off-site—sounds solid, but it doesn't account for ransomware that hides in your system for weeks, quietly corrupting every backup you make. NIST SP 800-209 warns that attackers go after backups, not just your primary data, and they can tamper with the backup process itself to slowly poison future copies. So that 'safe' local backup might be a disaster waiting to happen.

The real question isn't should you have a local backup. It's how do you make it ransomware-proof and actually recoverable when you need it. Let's dig in.

Local Backup Alone Is Not a Strategy

Let me paint a picture. You're a freelancer. You back up your client files to a single external drive every night. One afternoon, you get an email with a malicious attachment. You open it, and boom—ransomware encrypts your entire system, including that external drive if it's connected. If it's disconnected, you think you're safe, but you haven't backed up in three days because you forgot. That's not a strategy. That's a single point of failure—a phrase that gets thrown around, but here it's literal: one drive, one copy, one failure.

The 3-2-1 rule is a good baseline, but it's not enough for ransomware. CISA's updated guidance pushes a 3-2-1-1-0 rule: three copies, two media types, one off-site, one immutable or air-gapped, and zero unverified backups. Immutable means the data is locked—can't be altered or deleted once written, as NIST SP 800-209 defines. Air-gapped means completely disconnected from your network. And you must verify that your backups actually restore. An untested backup is an assumption, and NIST's contingency planning guidance is clear: high availability (like replication) is not a substitute for backups.

RPO and RTO: The Numbers That Drive Everything

Before you buy another drive, answer two questions: How much data can you afford to lose? And how fast must you recover? These are your Recovery Point Objective (RPO) and Recovery Time Objective (RTO). NIST defines RPO as the maximum acceptable data loss measured in time—the latest point to which data can be restored. RTO is the maximum acceptable downtime before systems and business functions must be restored. For example, if your financial database can't lose more than five minutes of transactions, then your backup interval—whether snapshot, incremental, or continuous—must be five minutes or less, as NIST SP 800-209 advises.

Here's the catch: a local backup alone can't meet a tight RPO unless you're doing continuous data protection (CDP), where changed blocks are continually transmitted to a target and journaled over time. That's not what an external drive does. An external drive is a full or incremental backup that runs on a schedule—say, nightly. If you run a full backup at 2 a.m., and your system crashes at 2 p.m., you lose 12 hours of work. That might be fine for personal photos, but for a business, it's a disaster.

So, you need to tier your data. NIST recommends organizing your data protection plan by data type—Tier 1, Tier 2, etc.—and specifying frequency, number of copies, and recovery goals for each tier. Mission-critical systems often get an RTO under 1 hour and an RPO under 5 minutes, while less critical systems can tolerate longer times. That means your local backup is probably fine for Tier 2 stuff, but for Tier 1, you need something faster—maybe snapshots every 5 minutes or CDP. And remember, snapshots are not backups. NIST SP 800-209 notes that if the source data is unavailable, the snapshots will often not be usable either because they're stored on the same system. So don't rely on snapshots alone.

Build a Local Backup That Survives Ransomware

Here's a concrete plan. First, get two external drives, not one. Use one for daily backups, keep it connected only during the backup window, then disconnect it. The second drive is your weekly off-site copy—rotate it to a safe deposit box, a friend's house, or a cloud provider. That's your 3-2-1 baseline. But to get to 3-2-1-1-0, you need that immutable or air-gapped copy. If you're using an external drive, the air gap is the disconnection. But you must also encrypt the drive and store the encryption keys separately—never with the data. CISA's ransomware response checklist says to restore from offline, encrypted backups, but if you can't decrypt, you're stuck.

Second, test your backups. NIST SP 800-209 recommends testing at least monthly for critical data, and if you have strict restoration speed requirements, do an end-to-end test restore to a sandbox environment. Yes, that means actually booting from your backup and checking that your files are intact. It's tedious, but it's the only way to know your backup isn't garbage. And no, that doesn't mean you need to do it every week for everything—but for your most critical systems, do it monthly. A single test failure that you catch is better than a crisis where you discover your backup is corrupt.

Third, keep an up-to-date recovery catalog—a list of every backup copy, when it was made, and the results of anti-malware scans. Periodically scan at least a subset of past copies with current anti-malware tools to identify poisoned copies. That's straight from NIST SP 800-209. If you find a poisoned copy, you can quarantine it before it spreads.

Finally, don't forget the off-site piece. Local backup is not off-site. If your house burns down, your external drive goes with it. CISA's #StopRansomware Guide, updated in 2023, emphasizes the need for offline, encrypted backups—and that includes an off-site copy. So even if you're a home user, get a cheap cloud storage plan or a second drive that you keep at a family member's house.

Quick tip: If you're using a USB drive, format it as exFAT or NTFS so it works across systems, and use a backup tool that supports versioning—so you have multiple points-in-time, not just one snapshot. That way, if ransomware encrypts your files, you can restore to the version from before the infection.

Bottom Line

The single best move is to implement a 3-2-1-1-0 strategy with a tested, air-gapped local copy. That means: three copies, two media types, one off-site, one immutable or air-gapped, and zero unverified backups. Your local backup is only as good as your last restore test, so schedule it monthly and actually restore something. If you do that, you'll be ahead of 99% of home users and most small businesses.

Sources

• CISA - https://www.cisa.gov/stopransomware
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• NIST SP 800-34 Rev. 1 - https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
• CISA ransomware response checklist - https://www.cisa.gov/stopransomware/ive-been-hit-ransomware
• NIST (contingency planning glossary) - https://csrc.nist.gov/glossary