Data Backups and the 3-2-1 Rule
A good backup is the difference between a minor annoyance and a disaster. Whether it is ransomware, a dead hard drive, a lost laptop, or an accidental delete, backups let you recover. The trusted approach is the 3-2-1 rule.
The 3-2-1 rule
It is an easy formula to remember:
- 3 copies of your important data (the original plus two backups).
- 2 different types of storage (for example, an external drive and the cloud).
- 1 copy kept off-site or offline, so one event cannot destroy everything.
Why it matters
Ransomware often tries to encrypt connected backups too. An offline or off-site copy is what lets you refuse to pay and simply restore. Backups also cover the everyday disasters, hardware failure, theft, and human error, that are far more common than attacks.
Backup best practices
Make your backups dependable:
- Automate backups so they actually happen.
- Keep at least one copy offline or immutable (ransomware cannot reach it).
- Test your restores, an untested backup is only a hope.
- Encrypt backups that contain sensitive data.
How it plays out in the real world
Based on real, widely reported incident patterns; names and details are illustrative.
The backup drive in the desk drawer
A design studio was hit by ransomware that encrypted every workstation, and the network-attached backup drive too, because it was always connected. Their backup strategy died with the network.
What saved the business was an external drive in a desk drawer, three weeks stale, from a partner's habit of making a monthly offline copy. They lost three weeks of work instead of eleven years.
- Connected backups share your fate. Ransomware hunts backup drives and network shares first. A copy the malware can touch is not a backup; it is a second victim.
- 3-2-1 exists for exactly this day. Three copies, two kinds of media, one offline or offsite. The offline copy is the one that pays for all the others.
- A backup untested is a hope, not a plan. Restore a few files on a schedule. The worst time to learn your backups are broken is during the ransom countdown.
Test yourself
Test your backup knowledge, free.
Frequently asked questions
Is saving files to the cloud enough of a backup?
Cloud sync is a good start, but if it instantly mirrors deletions or ransomware encryption, it may not save you. Follow 3-2-1: keep multiple copies, on different media, with one offline or with versioning enabled.
Why keep a backup offline?
Ransomware spreads to whatever it can reach, including connected backup drives and synced folders. A copy that is offline or immutable stays clean, so you can restore instead of paying.
How often should I back up?
Match it to how much work you can afford to lose. For important data, automated daily (or continuous) backups are ideal. The key is to automate it and to test that restores actually work.