Myth Buster: "Offline Secure Storage means giving up access"

The criticism sounds practical. If sensitive data is offline, surely the business has made it harder to use. It may be safer, but it is slower. Less accessible. More awkward. Something for archives, tapes and emergency recovery, not something a modern organisation can operate around.

That is the myth this article needs to separate properly.

Offline Secure Storage® does not mean the owner has given up access. It means the owner has stopped treating permanent network reachability as the default state for every important record, copy and asset.

That distinction matters because ransomware, credential theft and insider misuse all depend on reachability. A remote attacker can only enumerate, authenticate against, exploit, encrypt, delete or exfiltrate what a path allows them to reach. The path is not a detail. It is part of the control surface.

The UK's National Cyber Security Centre makes the underlying principle clear in its guidance on offline backups. An offline backup is digitally disconnected when it is not in use. It is connected only when required, and connection requests should be denied while it is in its cold state. CISA's StopRansomware guidance makes the same defensive point by recommending offline encrypted backups because ransomware commonly searches for accessible backups and attempts to encrypt or delete them.

Neither authority is saying that important information should become impossible to retrieve.

They are saying that unnecessary access paths create unnecessary risk.

That is the better starting point for this Myth Buster:

The question is not whether the data can ever be reached. The question is whether it should be reachable all the time.

Chapter 1What Offline Secure Storage actually changes

Offline Secure Storage is dedicated physical storage for selected information that does not need to remain continuously network connected.

In Firevault's model, the storage sits on dedicated customer hardware. When no approved session is active, the physical Layer 1 route to that hardware is disconnected. There is no standing network path or always-available IP service waiting for the next login attempt.

Access is not removed. It is made deliberate.

When a legitimate user needs the data, access begins through an authorised out-of-band command. That command is separate from the normal IP data path. The physical route is enabled for an approved session, identity is verified, the customer works with the files, and the route is physically disconnected again when the session ends.

The architectural change is therefore precise:

• The data remains available to the owner.
• The hardware remains installed and operational.
• Files can be uploaded, retrieved, searched, previewed and organised during an approved session.
• The route does not remain permanently present while nobody is using it.

That is the difference between access and exposure.

Chapter 2Why the myth exists

The phrase offline storage still carries old mental pictures.

A tape in a cabinet. A removable drive in a drawer. A person with a key walking into a store room. A recovery team waiting while somebody finds, transports and mounts media.

Those models can be valuable, but they also shaped a belief that offline must mean slow, manual and operationally distant.

Modern offline control does not have to depend on manual media handling. Firevault separates the protected network state from the act of physically retrieving storage. The hardware remains in place. The owner does not travel to a data centre to open a file. The path is created when an approved session requires it, and removed when that session is finished.

That makes offline a state, not a place.

The business question then changes. Instead of asking whether an organisation can tolerate a dusty archive, the more useful question is whether every sensitive asset really needs the same always-on model as a working application.

Many do not.

Board packs, signed agreements, completed matters, crown-jewel intellectual property, source releases, gold-copy recovery material, merger files, identity documents, export-controlled designs and long-term evidence may need to be preserved, controlled and accessed when required. They do not necessarily need to sit behind a permanently reachable network route every minute of the year.

Chapter 3The myths

Chapter 4Myth 1: Offline Secure Storage means giving up access

No. It means giving up standing access.

This is the central point. The owner can still reach the data through an approved process. What changes is that the route is not left in place for the rest of the time.

That distinction is easy to miss because most storage conversations treat availability as binary. Either the system is reachable, or it is not. But security architecture can be more precise than that.

There is permanent reachability, where the network path exists and controls decide who may use it.

There is controlled reachability, where the path itself is created only when there is an authorised reason for it to exist.

Offline Secure Storage belongs in the second category.

For the customer, the experience should be designed around intentional access: request the session, verify identity, use the files, close the session. For an attacker inside the ordinary connected estate, the default state is different. There is no live storage service to scan, authenticate against or attack while the instance is offline.

The customer has not lost access.

The attacker has lost a standing route.

Chapter 5Myth 2: Offline means inaccessible

Offline and inaccessible are not the same property.

Inaccessible means the legitimate owner cannot obtain the information when they need it. Offline describes the network state while the information is not being used.

The NCSC's backup guidance depends on that distinction. It recommends that offline backups are connected only when necessary, which would make no sense if offline meant permanently unreachable. The control is valuable precisely because the state can change for a legitimate purpose and then return to disconnection.

Firevault applies that principle to selected sensitive and vulnerable information, not only to emergency backup media.

During an approved OSS session, normal security controls still matter. The user's device matters. Identity matters. Logging matters. Permissions matter. Malware protection matters. The point is not to pretend that risk disappears once a session is opened.

The point is that risk is not left permanently available through an always-on path.

That is controlled availability: reachable when authorised, disconnected by default.

Chapter 6Myth 3: Offline Secure Storage is too slow for modern use

It depends what the data is for.

If a dataset supports a live application, high-frequency collaboration or constant operational processing, it belongs in a connected working environment. Offline Secure Storage should not be used as a performance gimmick or as a replacement for every ordinary file share.

But a great deal of valuable information is not used that way.

A board may need signed papers around governance events. A legal team may need completed matters occasionally over a retention period. A software company may need preserved release packages and source snapshots. A manufacturer may need master drawings, certification evidence and protected design files. A recovery team may need clean rebuild material after an incident, not constant daily editing.

For those assets, the relevant comparison is not whether a file opens as casually as a desktop document. It is whether the business benefits from leaving a permanent route to high-consequence information that is used only intermittently.

OSS is designed for that middle ground: not a forgotten archive, and not an always-on working store.

Access becomes an event with purpose, approval and a defined end.

That is not a usability failure. It is the control.

Chapter 7Myth 4: Offline Secure Storage is just backup with a new name

No. Backup is mainly about copies and recovery. Offline Secure Storage is about custody, reachability and control of selected data.

The two can overlap. An OSS instance may hold gold-copy recovery material, protected exports or files needed after a destructive incident. But it can also hold information whose main value is confidentiality, integrity, evidential strength or long-term preservation rather than routine restore activity.

That difference changes the conversation.

A backup strategy asks: can we restore systems and data after failure or attack?

An OSS strategy asks: which assets should not remain continuously reachable in the first place?

Those assets may include:

• signed governance records;
• intellectual property and source releases;
• completed legal matters;
• sensitive customer or identity records;
• gold-copy recovery material;
• corporate archives and evidential records;
• data retained because of legal, contractual or regulatory value.

Some of those records are backups. Many are not. They are business assets whose exposure model deserves its own decision.

Chapter 8Myth 5: Offline Secure Storage takes control away from the business

This is the emotional version of the myth, and it is important because customers do not only buy storage. They buy confidence that they will still be in control when the data matters.

The control question should be made specific.

Who owns the capacity? Who can request access? Who verifies the session? Who can see the files? Who decides when the connection begins? Who decides when it ends? What evidence is retained afterwards?

In ordinary connected storage, the route is normally assumed to exist. The business controls permissions on a path that is already there.

With OSS, the business can control another thing as well: whether the path exists at all.

That is not less control. For the right category of data, it is more control.

It lets the organisation separate possession of data from permanent reachability of data. It lets a customer say that a document, copy or record can be retrieved when authorised, without accepting that it should sit continuously exposed to the same network threat model as the live estate.

That is the practical promise behind the phrase online when you need it, offline when you do not.

Chapter 9The reality

Security teams and business leaders have been trained to think in trade-offs: secure but inconvenient, convenient but exposed, available but risky, offline but unusable.

That framing is too crude for the data estates organisations now hold.

Some information genuinely needs continuous availability. Production applications, active collaboration, live databases, operational workflows and customer-facing services all depend on connected systems. Taking them offline would be the wrong control.

But some information is valuable for a different reason. It must survive. It must remain confidential. It must retain integrity. It may need to be produced as evidence. It may be needed for recovery. It may be accessed only when a particular event, audit, dispute, transaction or incident requires it.

For that category, the assumption of permanent connectivity should be challenged.

The practical test is simple:

If nobody in the organisation needs this data right now, what is the reason for leaving a live route to it?

Sometimes there will be a good answer.

Often there will not.

That is where Offline Secure Storage earns its place. It does not replace live storage. It does not replace backup. It does not replace identity, encryption, endpoint security or recovery testing. It adds a different control to a different problem: the problem of unnecessary reachability.

Useful access should remain possible.

Permanent exposure should have to justify itself.

Chapter 10Offline Secure Storage vs always-connected storage

The architectural separation is straightforward.

Always-connected storage starts with a route. Security controls decide whether an identity, device, service or administrator should be allowed to use it.

Offline Secure Storage starts with no standing route. An approved out-of-band command has to create the physical path before the ordinary access controls become relevant.

In simplified terms:

• Connected storage asks: should this request be allowed?
• Offline Secure Storage first asks: should there be a route at all?

That first question changes the attack surface.

A compromised identity may still matter during an approved session. A malicious insider may still matter. A vulnerable endpoint may still matter. A user who removes data from the protected environment can still create risk elsewhere.

The control is not magic and it should not be sold as magic.

Its value is narrower and stronger than that. While the instance is offline, the normal IP estate has no standing network path to it. A remote attacker cannot simply discover another address, reach another login page, call another API or attack another storage service that remains permanently connected.

The route is absent until the customer deliberately creates it.

That is the point.

Chapter 11Why non-IP path control matters

The mechanism that creates access is as important as the fact that access exists.

If the system that reconnects protected storage is just another IP-accessible service inside the same environment the attacker is trying to compromise, it becomes part of the same problem. It must remain perfectly patched, perfectly configured, perfectly credentialed and perfectly defended at the very moment the rest of the estate may already be failing.

Firevault's OSS architecture separates that decision from the normal data path. The out-of-band command controls whether the physical Layer 1 route exists. The ordinary network route used to work with the files during an approved session is not the same path that decides whether the storage should become reachable.

That matters during compromise.

A ransomware operator does not need a philosophical debate about storage categories. It needs reachability, privilege and time. Remove the standing route and one of those assumptions changes before the attacker reaches the storage layer.

That does not remove the need for identity verification, careful operations, logging, malware controls and customer procedures. It does reduce the period in which the protected storage is remotely reachable through the normal environment.

Architecture cannot remove every risk.

It can remove some routes.

Chapter 12What good access looks like

The honest version of offline access has to be operational, not theatrical.

A customer should be able to know what is stored, request access, verify themselves, open an approved session, work with the relevant files and then return the instance to its disconnected state. The controls should be visible enough to trust, but discreet enough not to disclose sensitive arrangements unnecessarily.

That is why the supporting features matter.

File Share gives authorised users a practical way to organise, upload, retrieve, search and preview information inside the OSS instance. Vault Buddy provides a second trusted person route for continuity when the main account holder is unavailable.

Those features exist because disconnection alone would not be enough. A useful offline architecture has to answer the recovery and access questions as well as the isolation question.

The best test is not whether access feels permanently open.

It is whether access is clear, authorised, recorded and temporary.

Chapter 13Offline is a control, not a compromise

The point of this Myth Buster is not to persuade organisations to put everything offline.

That would be just as simplistic as leaving everything reachable.

The point is to make permanent reachability an active decision rather than a hidden default.

If information is constantly used by people, applications or processes, keep it in systems designed for that job. If information is high consequence but low frequency, consider whether it deserves a different state. If it is the evidence, copy or asset the business would rely on during a crisis, ask whether it should share the same live attack surface as the systems most likely to be compromised.

Offline Secure Storage is one answer to that question.

Not unavailable data.

Controlled availability.

Not permanent disconnection.

Disconnection by default.

Not giving up access.

Giving up unnecessary exposure.

Secured offline. Accessible on your terms.

Chapter 14Technical note

Offline Secure Storage describes Firevault's architecture for dedicated physical storage whose network path is physically disconnected outside authorised sessions. The specific security property being discussed is the absence of a standing network route while the instance is in its offline state.

This article does not claim that physical disconnection removes every possible risk. Physical access, insider risk, authorised sessions, endpoints, identities, customer procedures, encryption, monitoring and malware controls still matter. Once an OSS instance is connected for an approved session, it is deliberately reachable and normal cyber-security controls are relevant again.

Nor does this article claim that all data should be moved into OSS. Firevault positions OSS for selected sensitive and vulnerable information whose access pattern allows a different connectivity model. Live workloads, active collaboration and operational systems need connected infrastructure.

The NCSC uses a broader technology-neutral definition of offline storage and recognises that a digitally disconnected state can also be achieved through controls around cloud backups. Firevault's distinction is that the default separation is implemented physically at Layer 1, with the connection process controlled out of band from the normal IP data path.

Chapter 15Primary sources and further reading

The technical position above is grounded principally in Firevault's published Offline Secure Storage architecture, the NCSC's guidance on offline and ransomware-resistant backups, and CISA's StopRansomware guidance.

The NCSC recommends maintaining at least one backup offline, connecting offline backups only when necessary and making backup solutions capable of isolation. CISA recommends maintaining offline encrypted backups of critical information and testing their availability and integrity regularly because ransomware frequently attempts to locate and destroy accessible backups.

The preceding Myth Buster, Ransomware cannot hack immutable storage, establishes the starting point for this article by separating protection of the copy from protection of the path.

• NCSC, Offline backups in an online world
• NCSC, Protecting your organisation from ransomware
• NCSC, Principles for ransomware-resistant cloud backups
• CISA, StopRansomware Guide
• Firevault, Offline Secure Storage
• Firevault, 24/7 on-demand access
• Firevault, File Share
• Firevault, Vault Buddy