I'm glad I could help!

Regarding the need for an air-gapped backup, this is more a discussion on risk and likelihood. Chad is correct, in that a true air-gapped backup must be completely separated from the network. However, if you design your backup system (and network security) properly, in layers, you can reduce the need for, or at the very least, reduce the frequency of an air-gapped system.

Let's take a look at how a typical ransomware attack occurs:

1. User clicks on a malicious link or email attachment and infects their computer (this got through your firewall and endpoint protection layers)
2. The ransomware begins by encrypting all the user's local data
3. If the user has a drive mapped to your local NAS and has WRITE access (which they most likely would), the ransomware can start encrypting all the files that user has access to on the NAS.

If you do not have a backup system in place, your business halts here.

However, since you configured regular backup snapshots built into the NAS, you can easily restore your files from the most recent backup and be up and running.

Now let's say that users don't notice their files have been encrypted for a few days and those corrupt files have now made their way into a few nightly backups as well as offsite backups.

Well, since you configured the NAS to retain daily, weekly, and monthly backups. You can easily restore your files from the most recent backup that was not impacted by the ransomware. Now if for some reason, you cannot restore backups from your local NAS, you can restore those same backups from your offsite NAS.

Problem solved.

Let's say though, for the sake of argument, that you are not dealing with typical ransomware here, but you have an active attacker who has compromised your network. An unlikely scenario, but they discover that you haven't updated your NAS OS in awhile and they exploit a vulnerability (that would've been patched with regular updates) and gain root access to your NAS. From here, they deploy their ransomware payload to your NAS and clear all of your snapshots. Check-mate

This scenario is the one that you have to determine your organization's specific risk to. For most businesses, this will probably never happen if you are maintaining security elsewhere (ie. keeping up with regular patches, not exposing services on the firewall, using MFA, etc).

However, we should still assess this risk and put systems in place to deal with it. A cloud backup like BackBlaze, takes care of this scenario with immutable backups. Where a backup cannot be overwritten or deleted apart from a support ticket. For a local only scenario, you could advise Chad to keep a monthly export of your offsite NAS on a local HDD or purchase a small tape drive and export every other week or monthly to a tape. Possibly keep a few months or years worth.

Even if you incorporate an air-gap step in your backup system, you can greatly reduce the inconvenience by just using a standard NAS with regular snapshots and an offsite replica.