Your Local Backup Is a Time Bomb: Fix It Before Ransomware Does

Who This Is For (and Why You're Probably Wrong)

You think you're safe because you have an external drive plugged in. That's what I used to think, too. Then I read the FBI's 2024 report: ransomware complaints rose 9% and losses hit $12.5 million just from reported incidents (FBI IC3 2024 Internet Crime Report). And here's the kicker: attackers now go after your backups. NIST SP 800-209 warns that they target not just primary data but also its copies, and they can even poison the backup process itself. So that external drive sitting next to your computer? It's a time bomb. If ransomware hits, it'll encrypt that drive too—unless you've disconnected it, and even then, a fire or theft takes it out. The 3-2-1 rule—3 copies, 2 media, 1 off-site—is still the baseline (CISA), but I'm going to argue that for local backup, you need to go further: treat your local backup as a recovery tool, not an archive, and build it with immutability in mind.

Step 1: Define Your RPO and RTO Before You Buy Anything

Most people skip this and just buy a drive. That's backward. You need to know how much data you can afford to lose (RPO) and how fast you need to be back online (RTO). NIST defines RPO as the maximum acceptable data loss measured in time—the latest point to which you can restore. RTO is the maximum acceptable downtime. For a small business, mission-critical systems might need an RTO under 1 hour and an RPO under 5 minutes (NIST). For your personal photos, maybe you can lose a day. But here's the blunt part: if you're running a business, you probably need an RPO of 15 minutes or less, and that means you can't rely on a nightly full backup. You need something like continuous backup or frequent snapshots. NIST SP 800-209 advises that snapshots should be configured to meet your RPO—if you can't lose more than 5 minutes, take a snapshot every 5 minutes. That might sound aggressive, but it's the difference between losing an hour of work and losing a day.

Step 2: Build a Tiered Local Backup—Not One Big Folder

Stop lumping everything into one backup. NIST SP 800-209 recommends organizing your data protection plan by tier. Here's a concrete setup for a small office:

• Tier 1 (critical): Financial files, customer databases, legal documents. These get an RPO of 15 minutes. Use a NAS with snapshots every 15 minutes, plus a nightly full backup to a separate device.
• Tier 2 (important): Project files, marketing materials. RPO of 1 hour. Snapshots every hour, daily incremental backup.
• Tier 3 (archival): Old emails, completed project archives. RPO of 24 hours. Daily backup, weekly full.

For the actual backup types, use a mix. A full backup on Sunday, incremental backups during the week, and maybe a differential on Friday. Remember: incremental backups restore faster if you have the last full plus all incrementals; differential only needs the last full plus the most recent differential. And don't confuse snapshots with backups. A snapshot is a point-in-time copy, often using pointers, so it's quick and cheap, but if the source data is gone, the snapshot is often useless too (NIST SP 800-209). That's why you need a real backup, not just snapshots.

Step 3: Make Your Local Backup Immutable or Air-Gapped

Here's where I get controversial. The 3-2-1 rule is fine, but CISA's modernized 3-2-1-1-0 adds an immutable or air-gapped copy and zero unverified backups. Immutability means the data can't be altered or deleted after it's written (NIST SP 800-209). For local backup, you have two practical options: a WORM (Write-Once, Read-Many) tape or a cloud backup with versioning. Tape is the ultimate air gap—LTO-9 supports WORM and hardware encryption, and the LTO Program says tape provides an inherent air gap, which is why it's still around. But tape is slow for recovery. So my recommendation: use a local NAS with snapshots for fast recovery, but also write a copy to an immutable target—either a tape cartridge you rotate off-site or a cloud bucket with versioning (like S3 with Versioning enabled, which AWS Backup can use). The key is that the backup is offline or immutable, so ransomware can't touch it.

Warning: If you think a second hard drive in the same machine is enough, you're wrong. A power surge or ransomware will hit both. And never keep your only backup in the same building as your primary data—fire, flood, theft take out both. NIST SP 800-53 requires storing backup copies in a separate facility or fire-rated container.

Step 4: Test, Test, Test—Or It's Not a Backup

An untested backup is an assumption. CISA says to regularly test backups. NIST SP 800-209 recommends testing at least monthly for critical data, and doing an end-to-end restore to a sandbox for apps with strict RTO. Here's what a monthly test looks like: pick a random file from a month ago, restore it to a different machine, and verify it opens. Then, quarterly, do a full restore of your entire system to a spare machine. It takes time, but it's the only way to know your backup works. And keep a recovery catalog—NIST SP 800-209 says to record each copy and scan for malware. Because if you restore a poisoned backup, you've just re-infected yourself.

Quick tip: If you use VMware snapshots, remember they're not backups. Broadcom says a snapshot is just a change log, and if the base disks are deleted, the snapshot alone can't restore your VM. Also, don't keep a snapshot for more than 72 hours—it grows and can fill your storage.

What I'd Actually Do

Here's my blunt recommendation for a small business or serious home office: Buy a 4-bay NAS with at least two drives in RAID 1, set up a scheduled backup that runs every hour (incremental) and a full backup weekly. Enable snapshots on the NAS every 15 minutes for your critical folders. Then, once a week, copy the entire NAS to an external drive that you disconnect and store in a fireproof safe or a bank deposit box. That gives you a local copy for fast recovery, an immutable copy (the disconnected drive is air-gapped), and an off-site copy. That's your 3-2-1-1-0. And every month, test a restore. It's not glamorous, but it's the difference between a bad day and a business-ending event. Ransomware is only getting worse—the FBI says it's the most pervasive threat to critical infrastructure. Don't be the next statistic.

Sources

• CISA - https://www.cisa.gov/stopransomware
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• NIST SP 800-34 Rev. 1 - https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
• FBI IC3 2024 - https://www.ic3.gov/Media/PDF/AnnualReport/2024_IC3Report.pdf
• Broadcom VMware KB - https://knowledge.broadcom.com/external/article/318825/best-practices-for-using-vmware-snapshot.html
• LTO Program - https://www.lto.org/newsbytes-september-2022/