Why should tamper-proof snapshots be stored separately from primary volumes?

Storing tamper-proof snapshots on a separate volume, ideally in a different aggregate or cluster, provides an "air gap" or isolation. If the primary volume is compromised by a ransomware attack that encrypts or attempts to delete the volume, the isolated snapshot copies remain unaffected. This ensures that an immutable, unencrypted copy of the data is available for recovery. This separation is a critical component of a defense-in-depth strategy against ransomware, preventing the attack from spreading to the backup data.

A. Storing snapshots separately does not inherently reduce latency; it could slightly increase latency for restores compared to local snapshots.

B. Snapshot autodelete policies are managed at the volume level; separation does not simplify this process and could add management overhead.

D. Separating snapshots from their primary volume can reduce storage efficiency, as it may limit cross-volume deduplication opportunities.

1. NetApp. (2022). TR-4572: Ransomware Protection and Recovery with NetApp ONTAP. Section 3.2, "Isolate Data Copies". This document states, "To protect against an attack that compromises the primary storage system, you must have a copy of your data that is physically separate from the primary system."

2. NetApp. (2023). ONTAP 9.13.1 Documentation: Protect against ransomware. This guide recommends, "Create a logically air-gapped copy of your data by replicating it to a different cluster or to object storage." This logical separation isolates the backup data.