why backup needs an air gap

[stormy1]

And multiple copies so if the current media gets wacked.

http://www.cso.com.au/article/551527/synolocker_demands_0_6_bitcoin_decrypt_synology_nas_devices/

"Synology network attached storage (NAS) devices, capable of storing terabytes of data, have been targeted by ransomware that encrypts victims’ files.

Owners of Synology's NAS devices might want to unplug their storage boxes now to avoid being affected by ransomware that uses strong encryption to lock files on the brand’s machines and demands US$350 for the decryption key."

 

[devman]

Offline or otherwise air gapped backups should always be standard practice. Even before this threat targeting Synology a cryptolocker virus would encrypt things on mounted network drives and folder.

I rotate external harddrives for just this reason.

 

[Eulogy]

The good thing about the synology issue is that it requires an older version of DSM. If you've updated since december, you're safe. At least, safe-ish.
As to the main topic of the OP, air-gapped backups, I fully agree and don't quite understand why this isn't more commonly practiced.

 

[HobartTas]

As to the main topic of the OP, air-gapped backups, I fully agree and don't quite understand why this isn't more commonly practiced.

Because if say you use the ZFS filesystem in a NAS and make the data available on a network share and you snapshot it on a regular basis then the snapshotted data becomes immutable (as its now read-only) and therefore becomes completely IMMUNE to these cryptolocker type virii, the worst that can happen in that particular case is that the virus will think its encrypting your data but it will actually be writing a fresh copy and so you may find that your stored data could double in size (unless it fills up the NAS first).

To fix this all you would have to do is revert the entire filesystem to the last known good snapshotted time, however, you would lose all files newer than that snapshot that got encrypted. This might be a relatively small amount of data as you could snapshot as frequently as on an hourly basis as each snapshot itself only costs you a couple of hundred kilobytes of disk space (plus whatever changes made to files and retained deletions you've made in that time).

Cheers

 

[TCM2]

Don't allow management access from potentially insecure clients and allow write access to the data only for data that actually needs to be written - and then snapshot those areas frequently.

You don't need an air gap at all for _those_ threats.

 

[FLECOM]

The good thing about the synology issue is that it requires an older version of DSM. If you've updated since december, you're safe. At least, safe-ish.
As to the main topic of the OP, air-gapped backups, I fully agree and don't quite understand why this isn't more commonly practiced.

because at some point it becomes prohibitively expensive...

backing up tons of data is difficult and expensive