Cloud Backup vs Local Backup: What Actually Protects Your Business Data

Why Backup Is More Complex Than It Appears

Most small businesses have some form of backup in place — a network drive, a USB drive, or the assumption that cloud storage handles it. In practice, many of these arrangements do not provide the protection business owners believe they do.

The goal of backup is recovery: when data is lost — through accidental deletion, hardware failure, ransomware, or a software bug — backup allows you to restore it to a known good state. Whether you achieve that goal depends on the type of backup, where it is stored, and whether it has ever been tested.

What Cloud Storage Is Not

A critical misconception: cloud storage is not backup.

Microsoft OneDrive, Google Drive, and Dropbox are synchronisation tools. Files stored in these services are mirrored between your device and the cloud. If a file is deleted, the deletion syncs to the cloud within seconds. If ransomware encrypts your files, the encrypted versions sync to the cloud and overwrite the good copies.

Cloud storage services do offer some version history and recycle bin functionality, but these are limited in scope and duration. They are not a substitute for a dedicated backup solution.

Local Backup: Strengths and Weaknesses

Local backup stores data on hardware at your premises — a NAS (network-attached storage) device, an external hard drive, or a tape system.

Strengths:

• Fast restoration — copying data from a local device is much faster than downloading from the cloud
• Works without internet access
• No ongoing subscription cost for basic setups

• Vulnerable to the same physical event as the data being backed up — a fire, flood, or theft that affects your office affects your backup
• Ransomware frequently targets local backup drives — if the NAS is connected to the network, ransomware can encrypt the backup too
• Requires physical management — drives fill up, hardware ages, backups can silently fail without monitoring

Cloud Backup: Strengths and Weaknesses

Cloud backup (Veeam, Backblaze Business, Acronis, or Microsoft 365 Backup) stores copies of your data offsite on the provider's infrastructure.

Strengths:

• Offsite location protects against physical events and ransomware (if properly isolated from the network)
• Monitored and managed services alert when backups fail
• Scales without hardware investment

• Restoration speed depends on internet bandwidth — large restores can take many hours
• Ongoing subscription cost
• Requires internet connectivity to access

The 3-2-1 Rule

The widely recommended approach: keep 3 copies of your data, on 2 different media types, with 1 copy offsite.

For a small business, this practically means: the live copy on your computers/server, a local backup on a NAS device, and a cloud backup of the same data. When ransomware strikes, the cloud copy is unaffected. When the internet is down and you need to restore quickly, the local copy is available.

Testing Is Non-Negotiable

A backup that has never been tested is not a backup — it is an assumption. Backup failures are common: drives fill silently, backup jobs error and nobody notices, the backup file is corrupt. Testing quarterly — actually restoring a file from the backup — confirms that recovery will work when you need it.

Ransomware and Backup: The Critical Distinction

The most important thing to understand about backup and ransomware is that ransomware specifically targets backup. Modern ransomware attacks do not just encrypt the live data — they actively look for and encrypt backup drives, delete Volume Shadow Copies (Windows built-in backup snapshots), and in some cases attempt to reach network-connected backup destinations.

This has important implications for backup design:

Local backup drives must be isolated from the network. A NAS device connected to the same network as your computers is accessible to ransomware. If ransomware can reach the backup drive (and it will try), it will encrypt the backup. Options: physically disconnect the backup drive after each backup run (impractical for most businesses), configure the backup software to use a protocol the ransomware cannot traverse (some dedicated backup solutions do this), or ensure the cloud backup is the recovery path for ransomware events.

Cloud backup must be air-gapped. Cloud backup that syncs directly from the source (like a cloud-based file sync) can be encrypted by ransomware just as the local copies are. Proper cloud backup solutions use a push mechanism from the backup agent — the cloud destination cannot be reached directly from the network, only the backup software can write to it. Services like Veeam Cloud Connect, Acronis Cyber Backup, and purpose-built managed backup solutions implement this properly.

Immutable backup. The gold standard for ransomware protection is immutable backup — backup copies that cannot be modified or deleted for a specified retention period, even by an authenticated administrator. Cloud backup services that support immutability (Wasabi with immutability enabled, Backblaze B2 with Object Lock) provide protection even if an attacker gains admin credentials.

Microsoft 365 Backup: The Misunderstanding

A very common misconception: "We are on Microsoft 365, so our data is backed up."

Microsoft 365 provides high availability — your data is replicated across multiple Microsoft data centres so it is not lost due to Microsoft infrastructure failure. But Microsoft's retention and recovery features are not the same as backup:

Deleted item recovery has time limits — typically 14-30 days for emails, 30-93 days for SharePoint/OneDrive, depending on configuration. After those windows, deleted items are permanently gone.

Ransomware on OneDrive. If ransomware encrypts files that are in a synced OneDrive folder, the encrypted versions sync to OneDrive and overwrite the good copies. Microsoft does provide version history (typically 30 days on Business plans), but restoring hundreds of thousands of files from version history requires a manual, time-consuming process.

Staff error. A staff member permanently deletes a SharePoint library or an email folder without realising the business impact. Without proper backup, recovery depends on Microsoft's retention settings — which may have already expired.

Dedicated Microsoft 365 backup solutions (Veeam Backup for Microsoft 365, AvePoint, Backupify) back up email, SharePoint, Teams, and OneDrive to an independent location on a daily or more frequent schedule. Recovery from point-in-time backup is fast and complete — not dependent on Microsoft's native retention windows.

Backup Recovery Time: Setting Realistic Expectations

Understanding how long recovery actually takes is important for business continuity planning.

Recovery from local backup (NAS). Copying 500 GB of data from a local NAS over a gigabit network takes approximately 1–2 hours. Restoring a server from local backup (image-based restore) might take 4–8 hours.

Recovery from cloud backup. Downloading 500 GB over a 100 Mbps internet connection takes approximately 11 hours. Over a 50 Mbps connection, 22 hours. Large cloud restores are measured in days. For businesses where the cost of extended downtime is high, cloud backup should be paired with local backup for faster recovery of critical data.

Microsoft 365 data recovery. Recovering a few specific emails or files from cloud backup is fast (minutes). Recovering an entire mailbox or SharePoint library is longer (hours, depending on volume).

Understanding these timeframes helps set appropriate recovery expectations and identify which data requires faster local recovery versus which can tolerate cloud recovery timelines.

Netluma IT designs and manages backup solutions for SE Queensland businesses — including proper air-gapped cloud backup, Microsoft 365 backup, and tested recovery procedures. Call 1300 521 162 to review your current backup arrangements.

Netluma IT manages and monitors backup for SE Queensland businesses as part of managed IT. Call 1300 521 162 to discuss your current backup arrangements.