Offsite backup for small businesses, including your NAS

Part of our Backup and recovery guide. See all guides.

Most small businesses back up to something in the office: a NAS, an external drive, a second server. That protects you from a failed disk or a deleted folder. It does not protect you from a fire, a flood, a burglary, or ransomware that reaches every device on the network. For that you need a copy somewhere else, and out of an attacker's reach. This guide covers what the NCSC says, and how to get a NAS backup offsite.

Why a NAS on its own is not enough

A NAS is a good place for backups to land. It is fast, it is local, and it makes restores easy. The problem is that it sits on the same network as everything else. The NCSC says it has seen numerous incidents where ransomware encrypted not only the original data on disk, but also the connected USB and network storage drives holding backups. It has also seen incidents that compromised connected cloud storage locations containing backups.

The NCSC's ransomware guidance adds that there have been cases where attackers destroyed copied files or disrupted recovery processes before launching the attack. So the question is not only "is there a second copy?" but "can the attacker reach it?"

What the NCSC says about offsite and offline copies

The NCSC describes the 3-2-1 rule as at least 3 copies, on 2 devices, and 1 offsite. It says the rule is popular because it scales well, including using the cloud for the offsite copy, and gives confidence that critical data is safe from a localised incident. But it notes that 3-2-1 does not require any backup to be offline.

So the NCSC adds its own rule: keep at least one backup offline at any given time, so an incident cannot affect all of your backups simultaneously. Its ransomware guidance says it is essential to always have a recent offline backup of your most important files and data.

For small businesses, that gives a simple target: a local copy for fast restores, and at least one copy that is both offsite and offline. Our 3-2-1 backup rule guide covers the rule in more depth.

Your two options: cloud storage or removable media

The NCSC's guidance on backing up describes the two main places a backup can go: cloud storage on the internet, or removable media such as a USB stick or external hard drive.

Cloud storage. The NCSC says using cloud storage for an offline backup is a good idea because it guarantees physical separation from your live environment. The NCSC's personal backup advice also notes that cloud storage gives you the option to create backups automatically, but that it needs a reliable internet connection to back up and to restore, so it may not suit every site.

Removable media. A drive that is copied to, unplugged and taken off site is offline by design. In our view, it works for a small business with one person who reliably rotates the drives.

Making a cloud copy behave like an offline one

The catch with cloud storage is that you cannot unplug it. The NCSC says that when the offline backup is not in use it also needs to be digitally disconnected, and sets out how to get close to that:

• Secure the account. Everyone who can reach the cloud backups should be protected in line with NCSC password and multi-factor authentication guidance. Without a trusted identity, ransomware should not be able to get access to the storage.
• Limit backup clients. A backup client is a device with credentials to the cloud storage. The NCSC says clients should not hold valid credentials while the storage is not in use, there should be as few as possible, and standard user devices should not be able to change cloud backups directly.
• Allow writes, not overwrites. Where the service supports it, configure access so authorised clients can only create new backups or append to existing ones, and connection requests are denied while the storage is not in use. The NCSC says ransomware acting with privilege to only create new data cannot overwrite existing backups, which is comparable to traditional write-once storage.
• Keep earlier versions. The NCSC says some services can restore modified data to an older version and recover deleted data for a limited time. Check for those features when choosing a provider.

The NCSC's ransomware guidance also says multi-factor authentication should be enabled on backup accounts, and that the MFA method should not be installed on the same device used to administer the backups.

Locked storage: a copy nobody can delete

Some cloud object storage can lock a backup so it cannot be changed for a set time. Amazon S3 Object Lock is a documented example of how this works, and other providers offer similar features.

AWS describes two modes. In compliance mode, a protected object version cannot be overwritten or deleted by any user, including the root user of the account, and its retention period cannot be shortened. In governance mode, most users cannot delete or overwrite it, but users given a special permission can. AWS says governance mode can be used to test retention settings before creating a compliance mode retention period.

Each locked copy has a retain-until date, after which it can be deleted. That is where your backup retention policy comes in: the lock should last at least as long as you would need to go back after an attack you did not spot at once. Our guide to immutable vs air-gapped backups compares the two approaches.

How to back up a NAS offsite, step by step

These steps follow the NCSC principles. Most business NAS devices include a backup app that can send a copy to cloud storage or to an attached drive.

1. Decide what goes offsite. The NCSC's rule of thumb is to back up anything that would inconvenience you if you could no longer access it. Applied to a business, that could include the shared drive and any system exports kept on the NAS.
2. Pick the offsite target. Cloud object storage that supports versioning or locking, or a set of rotated removable drives.
3. Give the NAS its own credentials. Use a separate account for the backup job with only the rights it needs, not an administrator account, and turn on multi-factor authentication for the storage account itself.
4. Lock or version the copies. Turn on object lock or versioning at the destination so a compromised NAS cannot wipe the offsite history.
5. Encrypt, and keep the key safe. The NCSC warns that if a backup is encrypted, an attacker does not need to delete it if they can delete or change the key. It suggests options such as committing a master key to paper or a QR code and storing it in a secure location, such as a safe.
6. Turn on alerts. The NCSC says a backup service should raise alerts for significant changes such as mass deletion requests or backups stopping, delivered in a way that still works if your own systems are compromised.
7. Test a restore. Restore a few files, and once in a while a whole share, from the offsite copy. Our guide to how often to test disaster recovery plans covers how to plan restore tests.

Offsite backup and UK GDPR

The ICO's data security checklist includes making sure you can restore access to personal data in the event of any incident, such as by establishing an appropriate backup process. In our view, a copy kept away from the office is part of an appropriate process for most small businesses, because one incident in one building can otherwise take out both the data and its backups. Our guide to UK GDPR and backups covers retention and erasure requests that reach backups.

FAQ

Is a NAS an offsite backup?

No, not if it sits in the same building and on the same network as the data it protects. The NCSC has seen ransomware encrypt connected USB and network storage drives that held backups, so a NAS needs its own copy somewhere else.

What is the best way to back up a NAS offsite?

Copy it to cloud storage that is digitally disconnected when not in use and can keep earlier versions, or to removable media taken off site. The NCSC says at least one backup should be offline at any given time.

Is cloud storage enough as an offsite backup?

It gives physical separation, which the NCSC says is a good idea, but it also needs to be digitally disconnected, protected by strong account security, and able to restore older versions or recover deleted data.

Do small businesses need offsite backups under UK GDPR?

The ICO's security checklist includes making sure you can restore access to personal data after an incident, such as by establishing an appropriate backup process. In our view, a copy kept off site is part of an appropriate process for most businesses.

How do I stop ransomware deleting my offsite backup?

The NCSC recommends backup clients that hold credentials only while a backup runs, accounts protected by multi-factor authentication, and storage that can restore older versions or recover deleted data. Locked object storage in compliance mode adds a copy that no user can delete until its retention period ends, short of deleting the AWS account itself.