---
title: Comparing Methods for Securing Backups
description: When using a software-defined backup solution, you typically have several decisions to make in how you arrange the infrastructure and operational workflow.
image: https://www.calamu.com/hubfs/resources/comparing-blog.webp
---
✨ Calamu featured in Gartner Emerging Tech Report. [Learn more. ](https://www.calamu.com/press-release/calamu-featured-in-gartner-emerging-tech-report)
**We’re hiring!** [**Open Positions**](https://www.calamu.com/careers#open-positions)
- Product
- - [Data Harbor The world's most secure and resilient solution to prevent cyber attacks on data. Prevent cyber attacks on data.](https://www.calamu.com/data-harbor)
- - [Patented Process](https://www.calamu.com/calamu-process)
- Solutions
- - [Data Harbor The #1 cyber vault for backup and recovery applications The #1 cyber vault for backup and recovery applications](https://www.calamu.com/data-harbor)
- - [Calamu for Veeam](https://www.calamu.com/veeam)
- [Calamu for Veritas](https://www.calamu.com/veritas)
- [Calamu for Dell](https://www.calamu.com/dell)
- [Calamu for Nutanix](https://www.calamu.com/nutanix)
- [Calamu for Wasabi](https://www.calamu.com/wasabi)
- [Calamu for StarWind](https://www.calamu.com/starwind)
- [S3-Compatible Data Harbor](https://www.calamu.com/calamu-for-backups)
- Resources
- - [Blog](https://www.calamu.com/blog)
- [All Resources](https://www.calamu.com/resources)
- Company
- - [Calamu Named in Gartner Hype Cycle Report The inclusion is a testament to Calamu's innovative approach and role in shaping cyberstorage. The inclusion is a testament to Calamu's innovative approach and role in shaping cyberstorage.](https://www.calamu.com/press-release/calamu-named-sample-vendor-in-gartner-2024-hype-cycle-report)
- - [About](https://www.calamu.com/about)
- [News](https://www.calamu.com/news-press)
- [Careers](https://www.calamu.com/careers)
- [Partners](https://www.calamu.com/partners)
- [Contact Us](https://www.calamu.com/contact-us)
[Contact Sales](https://www.calamu.com/contact-sales) [Login](https://www.calamuprotect.com/login)
[Resource](https://9291420-hs-sites-com.sandbox.hs-sites.com/resources) > Blog
# Comparing Methods for Securing Backups
September 12, 2023 5 Min Read
By: Nick Ryan
SHARE THIS:
> *The following is an excerpt from the Solution Guide: How to Improve Your Backup Data Security. [Click here for free access to the full document.](https://info.calamu.com/solution-guide)*
Secure backups use a combination of implementation best practices and cybersecurity technologies. When using a software-defined backup solution, you typically have several decisions to make in how you arrange the infrastructure and operational workflow. The decisions you make will have an impact on business resilience, backup performance, security, complexity, and cost.[](https://info.calamu.com/solution-guide)
### The 3-2-1 Backup Rule
Most backup vendors agree that the 3-2-1 rule is critical to maintaining data availability and mitigating the impact of cyber threats including ransomware.1 The rule indicates the following:
• 3 different copies of data
• 2 different types of media
• 1 of which is offsite
Here’s an example using Veeam, but any software-defined backup solutions can be configured in a similar way:
### Determining Storage Media for the Offsite Copy
Although the idea is simple, the options for implementing this strategy are varied starting with the most critical decision: choosing the right storage media. When it comes to storing backups, there are generally 3 options for the type of repository: Local online media, offline media, and cloud. Each of those options can have advantages and disadvantages.
| Storage Types | Advantages | Risks |
| --- | --- | --- |
| Online Media (SSD, HDD) | • Greater control over your data • Faster performance • Readily accessible • Perform routine health checks | • Networked media can be more easily compromised • Hardware failure and EOL upgrades • Offsite management and overhead • Can be costly to scale |
| Offline Media (LTO Tape) | • Can potentially be less expensive • Physical air-gap is more secure | • Slower to restore in a disaster • Hardware failure • Offsite management and overhead • Limited health checks • Less accessible |
| Cloud (Object Storage) | • Makes the offsite copy fast and easy • Performance options • Affordable • Endlessly scalable • Multiple provider options | • Less control over your data • Misconfiguration is a common risk • Cloud outages and downtime • Supply chain and backdoor exploits |
### **Applying Cybersecurity Controls**
Secure backup repositories typically use one or a combination of the following cybersecurity controls. An ideal solution uses a combination of technologies, while also optimizing for performance, costs, and accessibility. It’s often ideal to find an existing, balanced vendor or solution to configure secure backup storage.
| **Security Method** | How it protects data | Concerns |
| --- | --- | --- |
| Encryption | Encrypted backups are unreadable without the decryption keys, securing against theft attempts. | Emerging attack vectors including steal-now-decrypt-later, compromised decryption key management and quantum computing undermine traditional encryption methods. Additionally, hackers using compromised administrator credentials can decrypt the data. |
| Third-party Key Management | Separating the encrypted data from the decryption key reduces the chance that threat actors will get access to both. | Outsourcing to a third party may increase cost and complexity, and needs to be implemented correctly. |
| Immutability (WORM) | Immutable backups ensure that data in the repository cannot be altered for a period of time. | Immutability alone does not protect data from exfiltration attacks, and can be circumvented via stolen privileged credentials or with some backdoor exploits. |
| Multi-Factor Authentication | Requiring additional methods of determining user identity to prevent unauthorized users from accessing data. | Some software-defined backup solutions don't offer MFA protection before restoring or exfiltrating data, or the ability to add custom checkpoints. Additionally, insider threats or misconfiguration can result in data exposure. |
| Physical Air-Gapping | Air-gapped solutions restrict all wired access to the data repository including email clients, browsers, SSH and FTP. | Failure points exist during data transfer through USB installers, exploits on remote code executions and trojans. Additionally, restore times from backup are long and the process can be expensive and cumbersome. |
| Logical Air-Gapping | Creating a logical separation between the production environment and the backup repository adheres to zero-trust frameworks while maintaining overall data availability. | Logical or virtual air-gapping is only as strong as the vulnerabilities affecting the storage itself, and the measures taken to avoid privileged credential compromise. |
### **Introducing the Data Harbor: Accessible Storage with Zero-Trust Controls**
A Data Harbor is an approach to cloud storage that offers unique advantages and mitigates many of the risks. It functions just like any S3-Compatible object storage. However, instead of files being sent to a single cloud in their entirety, the file is fragmented across multiple clouds in a RAID type configuration with no single cloud storing a complete file or object. This architecture inherently removes any single point of failure.
Data is secure from theft and exfiltration, malicious encryption, deletion, or manipulation – all the tactics commonly used by ransomware actors. The data is also redundant across clouds, maintaining accessibility if one cloud experiences an outage or downtime.
Multi-Cloud Data Harbors combine physical security and cyber security, and are well suited to achieving 3-2-1 while also improving download speeds and backup performance.
Click below to download the full Solution Guide.
[](https://cta-redirect.hubspot.com/cta/redirect/9291420/e5a7f375-0682-487a-9220-aba5135769c8)
## Resources
#### [ Blog Earthquakes Don’t Deliberately Undermine Your Layered Defenses June 30, 2023 Why data backup is not a one-size-fits-all disaster recovery solution and how to secure your last line of defense with a Data Harbor. Read Article](https://www.calamu.com/blog/earthquakes-dont-deliberately-undermine-your-layered-defenses)
#### [ Blog Lessons Learned from 2023’s Biggest Ransomware Attacks December 28, 2023 Studying the biggest attacks of the year gives us important insights into how attacks are changing and what defenses we need to combat them in the future. Read Article](https://www.calamu.com/blog/lessons-learned-from-2023s-biggest-ransomware-attacks)
## Resources
#### [ Blog Earthquakes Don’t Deliberately Undermine Your Layered Defenses June 30, 2023 Why data backup is not a one-size-fits-all disaster recovery solution and how to secure your last line of defense with a Data Harbor. Read Article](https://www.calamu.com/blog/earthquakes-dont-deliberately-undermine-your-layered-defenses)
#### [ Featured Veeam Campaign - Webinar Registration July 12, 2023 Join Calamu and Veeam for a live discussion on improving backup data security and availability, and achieving 100% operational resilience. Read Article](https://info.calamu.com/webinar-securing-backups)
## See Calamu in Action.
[Get a Demo](https://www.calamu.com/get-started)
Main Street, Clinton, NJ, 08809, US
**[+1 929-450-4200](tel:9294504200)**
**[info@calamu.com](mailto:info@calamu.com)**
- Why Calamu
- [Calamu Protect™](https://www.calamu.com/calamu-protect)
- [Our Patented Process](https://www.calamu.com/calamu-process)
- [FAQs](https://www.calamu.com/faq)
- Solutions
- [S3-Compatible](https://www.calamu.com/calamu-for-backups)
- [Veeam](https://www.calamu.com/veeam)
- [Dell](https://www.calamu.com/dell)
- [Veritas](https://www.calamu.com/veritas)
- [Nutanix](https://www.calamu.com/nutanix)
- [Wasabi](https://www.calamu.com/wasabi)
- [Starwind](https://www.calamu.com/starwind)
- [Regulatory Compliance](https://www.calamu.com/solution/compliance/)
- Resources
- [Resources](https://www.calamu.com/resources)
- Company
- [About](https://www.calamu.com/about)
- [News](https://www.calamu.com/news-press)
- [Careers](https://www.calamu.com/careers)
- [Partners](https://www.calamu.com/partners)
- Connect
- [Contact Us](https://www.calamu.com/contact-us)
- [Get a Demo](https://www.calamu.com/get-started)
© 2026 Calamu Technologies Corporation. All rights reserved.
[Privacy Policy](https://9291420-hs-sites-com.sandbox.hs-sites.com/privacy-policy)