Offline copies break attacker reachability
A copy that is not connected to anything cannot be encrypted, deleted or altered by somebody who has taken over your network.
It is the oldest idea in backup and it keeps being rediscovered after incidents, because everything online is reachable by definition. The inconvenience is real: slower to restore, more manual. That inconvenience is exactly the property that makes it survive.
More on Backups and recovery
- Immutable backups trade flexibility for protectionSet in concrete
- RPO and RTO answer different questionsTwo different clocks
- Restoring data can restore malware tooThe newest jar is the spoiled one
- Backup credentials deserve separate protectionNot on the same switch
- Recovery order follows dependenciesBottom crate first
- Backup retention determines how far back you can restore to escape corruption or compromiseAs far back as the rope goes