That's not precisely true, depending upon the definition of 'competent'.

I've seen 'competent' backup solutions which had backup rotations that expired older content. And I've read post-incident responses where hackers slowly corrupted older records. And (via reading corporate wikis and docs), determined how long they had to wait, for backups to become tainted.

But I agree. True competent backup methods, including periodic backup restoration tests and other methods, can ensure a degree of protection. Still, one can end up with months of "bad backups" due to a hacker interceding in the process or corrupting records slowly, thus invalidating more recent backup sets post-hack. While this didn't happen with Equifax, the hackers were in there for 8 months slowly exfiling information.

So you can have a load of backups with questionable integrity.

Really, what I'm comparing here is indelible backups vs not. It could be holographic, write only storage for all I care. It's just that "paper" backups, which move to microfiche, have a century long history of how to deal with it. How to ensure they're good. How to keep duplicates, resolve security, and all that.

Meanwhile, most people dealing with the software side simple think "Oh, we can make this situation secure. We can make software secure."

This thought process is entirely wrong. Software is never secure. If you use software + a database or other store for data, it's not secure. And so, placing it online is just plain stupid.

Of course, you speak to other options. No external network connection, for example. And this is all well and good! And it significantly reduces the attack vector.

But of course, and lots of high security environments do this, you then have to ban staff from bringing in all phones, computers, and other devices. I read a post-action report where people's phones were hacked, and basically acted as a 2G modem (at the time) into wifi on an isolated network of a nuclear power plant. And due to the thought process of "We're 100% air gapped, who cares!", the hack was apparently an easy one.

But really, the difference is... how many people can attack your citadel.

The internet means billions. No network connection means hundreds.

It's just that simple. And I think you agree, mostly.