1 Overview
Snapshots are point-in-time copies of a storage volume that allow quick rollback after accidental deletion or logical corruption. They are not independent backups because they reside on the same storage system and are vulnerable to the same failures, ransomware, or administrative errors that affect the primary data. A snapshot can be deleted or encrypted along with the source volume, leaving no recovery path. This article explains why snapshots alone are insufficient and how a layered strategy combining snapshots, dedicated backup software, and tape or offsite copies provides true resilience.
The core principle is the 3-2-1 rule: keep at least three copies of data, on two different media types, with one copy offsite. Snapshots count as one copy but must be paired with independent backups. Backup software creates full and incremental copies that are stored separately, often compressed and encrypted. Tape remains a cost-effective, air-gapped medium for long-term retention and disaster recovery. Together, these layers protect against a wide range of threats, from hardware failure to ransomware.
This guide is for IT professionals and business owners who need to design or validate a backup strategy. It covers what you are protecting against, how to choose a strategy, the practical application of the 3-2-1 rule, the importance of restore testing, and the role of offsite storage and encryption. By the end, you will understand why snapshots are not backups and how to build a robust, testable recovery plan.
2 What you are actually protecting against
Data loss can stem from many causes: hardware failures, software bugs, human error, malicious attacks, and natural disasters. Hardware failures include disk drive crashes, controller malfunctions, and power outages that corrupt writes. Software bugs may silently corrupt databases or file systems, and human error—such as accidental deletion or overwriting—is a leading cause of data loss. Ransomware and other cyberattacks can encrypt or destroy both primary data and any snapshots stored on the same system. Natural disasters like fires, floods, or earthquakes can physically destroy an entire data center.
Snapshots protect against a narrow subset of these threats. They are useful for quick recovery from accidental file deletion or a failed software update, because they provide a near-instant rollback to a previous point in time. However, snapshots are typically stored on the same storage array as the primary data, so they offer no protection if the array fails, is stolen, or is compromised by ransomware. They also have limited retention and can consume significant storage space, often leading to frequent deletion.
A true backup must be independent, meaning it is stored on separate media or in a separate location, and it must be immutable or air-gapped to resist tampering. Backups also need to be verified and tested regularly. Without independence and testing, you cannot rely on snapshots or any single copy to recover from a major incident. Therefore, understanding the threat landscape is the first step in designing a resilient backup strategy.
3 Choosing a backup strategy
A sound backup strategy begins with defining recovery objectives: recovery point objective (RPO) and recovery time objective (RTO). RPO determines how much data you can afford to lose, which dictates backup frequency. RTO defines how quickly you must restore operations, which influences the type of backups and restore methods you use. For critical systems, you might need an RPO of minutes and an RTO of under an hour, while less critical data can tolerate longer windows. These objectives should be agreed upon by business stakeholders and documented.
Next, select a mix of backup types. Full backups capture all data but require more storage and time. Incremental backups only capture changes since the last backup, reducing storage and time but requiring a chain of backups to restore. Differential backups capture changes since the last full backup, offering a balance. Synthetic full backups combine incrementals to create a new full backup without re-reading all data. Many organizations use a combination: periodic full backups with frequent incrementals, plus snapshots for rapid rollback.
Finally, choose media and locations. Disk-based backups are fast for restore but can be expensive and vulnerable if kept online. Tape is inexpensive, durable, and can be stored offline, making it ideal for long-term retention and disaster recovery. Cloud storage offers offsite protection with scalability, but consider egress costs and security. A layered approach—snapshots for quick recovery, disk backups for operational restores, and tape or cloud for archival and offsite—ensures you meet your RPO/RTO without breaking the budget. Always encrypt backups and test restores regularly.
4 The 3-2-1 rule in practice
The 3-2-1 rule is a simple, vendor-neutral guideline: maintain at least three copies of your data, store them on two different media types, and keep one copy offsite. In practice, this means you might have the primary data on a production storage array, a snapshot on that same array (copy one), a backup on a separate disk appliance (copy two), and a tape or cloud copy stored offsite (copy three). The two media types could be disk and tape, or disk and cloud. The offsite copy protects against site-wide disasters and provides an air gap against ransomware.
Implementing 3-2-1 requires careful planning. First, ensure that snapshots are not counted as one of the three copies if they reside on the same system as the primary data, because they share the same failure domain. Instead, treat snapshots as a supplementary tool for fast recovery. Your independent backups should be stored on separate hardware, with access controls that prevent unauthorized deletion. For the offsite copy, use encryption and consider immutability features that prevent data from being altered or deleted for a set period.
Automation is key to consistency. Schedule backups to run automatically, and monitor for failures. Rotate tapes regularly if using tape, and verify that offsite copies are successfully transferred. Document your backup procedures and retention policies. Remember that the 3-2-1 rule is a minimum; for critical data, you might adopt 3-2-1-1-0 (add one offline copy and zero errors after verification) or similar variants. The goal is to eliminate single points of failure and ensure that at least one copy remains recoverable even if others are compromised.
5 Restore is the real test
A backup is only as good as its ability to restore. Many organizations discover too late that their backups are incomplete, corrupted, or cannot be restored within the required time. Regular restore testing is essential to validate your backup strategy. Testing should cover different scenarios: single file restore, full system restore, and application-level recovery. It should also verify that backups are readable, that encryption keys are available, and that restore procedures are documented and understood by the team.
Stress testing restores means going beyond simple file recovery. Simulate a disaster by attempting to restore critical systems to a separate environment, ideally without impacting production. Measure the actual restore time and compare it to your RTO. Identify bottlenecks, such as slow tape retrieval, network bandwidth limitations, or missing dependencies. Test restoring from each copy—snapshot, disk backup, and offsite tape or cloud—to ensure all layers work. Also test recovery from ransomware scenarios, where you might need to restore from an immutable or air-gapped copy.
Document the results and update your procedures accordingly. If a restore fails, investigate and fix the root cause. Consider automating restore verification where possible, such as booting a virtual machine from a backup and running health checks. Remember that encryption adds complexity: without the correct keys, backups are useless. Store keys securely and separately from the backups. Regular restore testing not only proves your backups work but also trains your team for real incidents, reducing stress and downtime during an actual disaster.
6 Offsite and encryption
Offsite storage is a cornerstone of disaster recovery. If a fire, flood, or theft destroys your primary site, an offsite copy is your only hope. Offsite can mean a physical location like a secure vault for tapes, a secondary data center, or a cloud region. The key is that the offsite copy is geographically separated and not dependent on the same power, network, or cooling infrastructure. For tape, this often involves a rotation schedule with a courier service. For cloud, choose a provider with strong security and redundancy, and understand their retention and deletion policies.
Encryption is critical for offsite data, especially when using cloud or transporting tapes. Encrypt backups at rest and in transit using strong algorithms. Manage encryption keys carefully: store them separately from the backups, and ensure they are backed up and accessible during a disaster. Losing keys means losing data. Consider using hardware security modules (HSMs) or key management services for added protection. Also, encrypt snapshots if they contain sensitive data, though snapshots are not a substitute for offsite backups.
When combining offsite and encryption, test that you can restore from the offsite copy using the keys. This end-to-end test validates both the data integrity and the key management process. Be aware that encryption can impact backup performance and restore times, so factor that into your RPO/RTO planning. Finally, ensure that offsite copies are immutable where possible, to protect against ransomware that might try to encrypt or delete them. With proper offsite and encryption practices, you can achieve a robust, compliant, and recoverable backup strategy.
7 Frequently asked questions
Q: Can I use snapshots as my only backup? A: No. Snapshots are not independent backups because they reside on the same storage system as the primary data. If that system fails or is compromised, snapshots are lost. Use snapshots for quick rollback, but always maintain separate backups on different media and offsite.
Q: How often should I test restores? A: Test restores at least quarterly for critical systems, and after any major change to your infrastructure or backup software. For highly critical data, consider monthly or even weekly tests. The frequency should align with your RTO and the cost of downtime.
Q: Is tape still relevant? A: Yes. Tape offers low-cost, long-term retention and can be stored offline, providing an air gap against cyberattacks. Tape is slower for restore, but for archival and disaster recovery, it remains a reliable and cost-effective option.
Q: What encryption should I use for backups? A: Use strong, industry-standard encryption such as AES-256 for data at rest and TLS for data in transit. Manage keys securely and separately from backups. Test that you can restore encrypted backups before you need them.
Q: How do I choose between cloud and tape for offsite? A: Consider your RTO, budget, and compliance requirements. Cloud offers faster restore and scalability but may have ongoing costs and egress fees. Tape has lower media costs but requires physical rotation and slower restore. Many organizations use both for a layered approach.
Q: What is the 3-2-1 rule? A: It is a guideline to keep three copies of data, on two different media types, with one copy offsite. It helps eliminate single points of failure and ensures recoverability from various disasters.