The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For most organizations, a hybrid backup design offers the strongest ransomware protection: keep a fast local copy for routine restores, an encrypted offline or otherwise isolated copy that production credentials cannot reach, and an immutable off-site or cloud copy when you can operate it securely. The label “offline” or “cloud” does not make a backup safe by itself. Isolation, immutability, access control, retention, recovery speed, and tested restores determine whether your backups survive an attack.
Why ransomware changes the backup decision
Ransomware is not only a file-encryption problem. An intruder may first steal administrator credentials, move through the network, find backup consoles, delete recovery points, encrypt attached drives, or alter retention settings. A backup that is visible through the same accounts and network paths as production can be damaged before anyone starts recovery.
That is why a backup plan must provide at least one recovery copy outside the attacker’s normal reach. The copy must also be usable: encrypted, retained for long enough, cataloged, and restored successfully in practice. A perfect copy that cannot be found or recovered is not a recovery plan.
“Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.” — Cybersecurity and Infrastructure Security Agency, #StopRansomware Guide
#1 Best Overall
WD 2TB My Passport, Portable External Hard Drive, Black, backup software with defense against ransomware, and password protection, USB 3.1/USB 3.0 compatible - WDBYVG0020BBK-WESN
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
CISA separately warns that an external drive should not remain connected when it is not actively being used for backup. If it stays attached, ransomware may be able to access, delete, or corrupt it.
Offline, cloud, and hybrid compared
| Decision factor | Offline backup | Cloud backup | Hybrid backup |
|---|---|---|---|
| Isolation | Strong when media is physically disconnected or air-gapped. | Depends on account security, network paths, permissions, and provider controls. | Combines physical separation with cloud or repository isolation. |
| Routine recovery speed | Often slower because media must be located, connected, scanned, and mounted. | Can be fast, but bandwidth and provider limits determine the result. | Uses a local copy for common restores and an isolated copy for major incidents. |
| Ransomware reach | Low while disconnected; much higher while attached. | Attackers may reach it through compromised credentials, excessive permissions, or synchronization. | Separates recovery copies so one compromised environment does not expose every version. |
| Scale and geographic resilience | Requires media rotation, secure storage, and off-site handling. | Geographic separation and retention can scale more easily. | Combines local availability with geographically separated capacity. |
| Administration | Manual handling, encryption, rotation, inventory, and restore testing. | Identity, retention, immutability, encryption, and provider configuration require continuous management. | Highest coordination burden, but the broadest recovery options. |
There is no authoritative, controlled statistic proving that one of these strategies always outperforms the others across organizations. The defensible choice is based on layered controls and your recovery objectives, not on a universal success percentage.
How an offline backup protects you
An offline backup is unavailable through ordinary production network connections while it is stored. A removable hard drive that is unplugged, a tape cartridge in a secure location, or a genuinely air-gapped system can provide this separation. “Offline” means inaccessible, not merely stored on a different folder or server.
What offline storage does well
- It blocks network-borne ransomware from reaching the copy while the media is disconnected.
- It provides a recovery point even if production servers, backup servers, and their credentials are compromised.
- It can be kept for long retention periods without depending on an internet service or subscription.
- It gives small teams a straightforward, understandable recovery copy.
Where offline storage fails
- An always-connected drive is not offline and can be encrypted or erased with other attached storage.
- Manual rotation can be skipped, leaving the only copy stale.
- Media can be lost, stolen, damaged, or unreadable without inventory and periodic verification.
- Restores can be slow when a large volume must be reconnected and scanned before use.
- If the same administrator account controls both production and the offline workflow, an attacker may compromise the process during a connection window.
Use a controlled connection window: connect the media only for a planned backup or restore, use a trusted and patched system, scan before and after the operation, record what was copied, then disconnect it. Encrypt the drive and store its encryption key separately from the drive.
How cloud backups help—and how ransomware can still reach them
Cloud storage can place copies in another geographic location, scale retention, and support features such as immutable retention or object lock. It can also help restore a last-known-good state after local systems are lost, a benefit noted by the UK National Cyber Security Centre.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Cloud is not automatically isolated. A ransomware operator with a stolen cloud administrator session, a shared password, an over-permissioned service account, or a synchronization path may be able to delete or overwrite recovery points. A cloud copy that mirrors deletions immediately can preserve the attack rather than the recovery history.
Controls required for a ransomware-resistant cloud copy
- Separate administration: Use dedicated backup identities and keep them outside ordinary production administrator groups.
- Strong authentication: Require phishing-resistant or otherwise strong multifactor authentication for backup administration and recovery.
- Least privilege: Give backup jobs only the permissions they need; separate write, read, delete, and retention-management roles where the service allows it.
- Immutable retention: Use object lock or an equivalent retention lock so a defined recovery period cannot be shortened by an attacker.
- Encryption: Encrypt data in transit and at rest, and protect keys separately from the account that stores the backups.
- Versioning and retention review: Confirm that deleted or changed source files remain recoverable for the period your business requires.
- Independent restore tests: Download or restore representative files and complete systems rather than trusting a successful upload log.
Cloud providers differ in the exact names and behavior of immutability, retention, key management, and recovery features. Verify the settings in your chosen service and document who can change them.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Why hybrid is the strongest default
Hybrid backup assigns different jobs to different copies. A local repository can restore a deleted document, a failed virtual machine, or a misconfigured application quickly. An offline or logically isolated copy remains available if the local network and backup credentials are compromised. An immutable off-site cloud or repository copy adds geographic resilience when a fire, flood, theft, or widespread compromise affects the primary site.
This design limits the blast radius of a single failure. It also avoids forcing every recovery through a slow internet transfer while preserving a recovery path that an attacker cannot alter through ordinary production access. The trade-off is operational: you must maintain more than one workflow, monitor all of them, and test that the copies are consistent and usable.
Start with the 3-2-1 rule, then add ransomware controls
CISA, the FBI, the National Security Agency, and the Multi-State Information Sharing and Analysis Center describe the 3-2-1 strategy as:
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
- Three copies of important data, including the production copy.
- Two different media types, reducing dependence on one technology or failure mode.
- One copy off-site, protecting against a site-wide incident.
The rule is a baseline, not a complete ransomware specification. The ordinary 3-2-1 wording does not itself require an offline copy, as the UK NCSC explains. Add these controls explicitly:
- At least one copy that is offline, air-gapped, or otherwise inaccessible to ordinary production credentials.
- Immutable retention for a cloud or repository copy where the technology supports it.
- Encryption for removable and cloud media, with separately protected keys.
- Separate backup administration and recovery credentials.
- Documented restore tests and a record of their results.
Build the backup plan step by step
- Inventory critical systems and data. List servers, endpoints, cloud applications, databases, configurations, identity systems, and any data that cannot be recreated. Identify dependencies such as directory services, encryption keys, certificates, and license files.
- Set the recovery time objective (RTO). Decide how long each service may be unavailable. A local copy may be necessary for systems with an RTO measured in hours or minutes; an offline shipment may be acceptable for lower-priority archives.
- Set the recovery point objective (RPO). Decide how much recent work the business can lose. A daily disconnected copy and a more frequent local or cloud copy may serve different RPOs.
- Create three copies on two media types. Count production plus backup copies, and place at least one copy off-site. Do not count multiple folders on the same disk as different media.
- Isolate one recovery copy. Disconnect removable media outside controlled backup and restore windows, or use an air-gapped or logically isolated repository. Ensure ordinary production credentials cannot log in and delete it.
- Encrypt every portable or off-site copy. Store keys in a separately controlled system or escrow process. Test that an authorized recovery operator can obtain the key without giving it to production administrators.
- Enable immutable retention where available. Set a retention period that matches legal, operational, and RPO requirements. Check who can alter or terminate the lock and require an independent approval for changes.
- Record each job and rotation. Track media identifiers, backup dates, coverage, encryption status, off-site location, and the person responsible for the next rotation.
- Test file-level and full-system restores. Restore individual files, a complete system, and the dependencies needed to bring a service online. Use a clean recovery environment rather than overwriting the only production copy.
- Review after changes and exercises. Re-test after major application, identity, storage, network, or retention changes, and include backup review in disaster-recovery exercises.
How often should you test a restore?
No single interval fits every organization. Tie the schedule to business risk: systems with a tight RTO or RPO need more frequent verification than rarely changed archives. Test after major configuration changes, migration, provider changes, or security incidents, and include restores in planned recovery exercises.
NIST’s guidance makes testing part of backup management rather than an optional audit. Its April 24, 2020 publication, Protecting Data from Ransomware and Other Data Loss Events, describes backups as information that must be conducted, maintained, and tested. NIST SP 1339, the OT Backup Quick Start Guide published June 17, 2026, likewise calls for regular creation and testing of backups and review during recovery exercises.
What a useful restore test records
- The recovery point selected and why it was considered clean.
- Whether the required keys, credentials, catalogs, and software versions were available.
- Elapsed time to locate, restore, validate, and return the system to service.
- Data-integrity checks, application checks, and user acceptance results.
- Failures, their owners, corrective actions, and the date of the next test.
A green backup-job status proves only that a job reported success. A completed restore proves that the recovery path works.
Choose a strategy by recovery requirement
Choose mostly offline storage when
- Your environment is small and manual media rotation is realistic.
- You need long retention without depending on a provider.
- Routine recovery can tolerate connecting and scanning media.
- You can secure the media, keys, inventory, and off-site location.
Choose cloud as one layer when
- You need geographic separation or scalable retention.
- Your internet connection can support the required restore volume and RTO.
- You can enforce separate identities, multifactor authentication, least privilege, encryption, and immutable retention.
- You have verified that provider-side deletion, retention, and object-lock settings behave as documented.
Choose hybrid when
- You need fast local restores and a separate disaster-recovery path.
- A compromise of local systems or credentials must not eliminate every recovery point.
- You can staff the additional monitoring, rotation, access review, and testing.
- You need both on-site availability and off-site geographic resilience.
Common failure modes and fixes
“The external drive is connected all the time.”
Risk: Ransomware can reach, encrypt, or delete it. Fix: disconnect it outside controlled backup and restore operations, and maintain more than one rotated copy so a single connection window does not become the only recovery opportunity.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
“The cloud backup mirrors every deletion.”
Risk: A malicious deletion propagates to the recovery copy. Fix: enable versioning and immutable retention, and confirm that retention cannot be shortened by the same account used for daily backup jobs.
“Backup and production use the same administrator account.”
Risk: One stolen credential can destroy both systems. Fix: create separate backup identities, restrict their privileges, protect them with strong authentication, and keep emergency recovery credentials offline or otherwise separately controlled.
“Backups complete, but restores fail.”
Risk: Corrupt media, missing keys, incompatible software, or an incomplete dependency set becomes visible only during an emergency. Fix: perform scheduled file and full-system restores, record the elapsed time and failures, and correct the process before the next exercise.
“The plan has 3-2-1 but no isolation.”
Risk: Three network-visible copies can be encrypted in one intrusion. Fix: add an explicit offline, air-gapped, or logically isolated copy and verify that ordinary production credentials cannot alter it.
Recommended Free Tools
Bottom line
Use hybrid protection as the default when you can operate it: a local copy for speed, an offline or isolated copy for blast-radius control, and an immutable off-site or cloud copy for site loss and extended recovery. If resources force a simpler design, prioritize an encrypted, disconnected copy and tested restores over adding another always-connected destination. Apply 3-2-1, separate backup administration from production, enforce immutable retention where possible, and treat every restore test as part of the backup itself.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
