3-2-1 backups: the one defence that actually stops ransomware

Backups do not prevent an attack. They prevent the attack from being the end of the company. They are the difference between losing an afternoon and losing the quarter.

And yet this is where we most often find the same scene: backups that exist, nobody knows whether they restore, and they sit on the same network as the data they are meant to protect.

Why paying does not fix the problem

Ransomware encrypts your files and then asks for money for the key. Even if you pay —and many get nothing usable— the real damage is not the encryption: it is the days of downtime, the revenue that does not come in and the customers who leave.

The only way around that equation is having the data back without depending on anyone. That is what backups are. Everything else is mitigation.

With one costly nuance: today's groups steal the data before encrypting it. A backup gives your systems back, but it does not erase what they already copied. That is why backups combine with two-factor, patching and segmentation rather than working alone.

The 3-2-1 rule, without the jargon

• 3 copies of the data: the original and two more.
• 2 different media: for example, a local disk and cloud storage. Two disks in the same cupboard are not two media, they are the same risk.
• 1 off the network: disconnected, in another location, or on storage that cannot be wiped from a compromised account.

The third point is the one almost nobody meets. A backup mounted as a network drive with the same credentials the user works with is a backup the ransomware encrypts too.

Immutable backups and air gaps

Two ideas that sound technical and are simple:

• Immutability: the storage prevents modifying or deleting what was written for a period, say 30 days. Not even you can delete it earlier. That is what stops an attacker with your password from destroying the history.
• Air gap: the media is not permanently connected. An external drive that is plugged in only to copy and then put away is a home-made air gap, and it works.

What almost nobody does: testing the restore

An untested backup is a hypothesis, not a fallback. The most common failure is not a missing backup: it is a backup that exists but is incomplete, encrypted with a key nobody has, or takes four days to restore.

Set a minimal, scheduled test:

1. Pick a random file and a complete folder.
2. Restore them on a clean machine, not on the production server.
3. Measure how long it takes and write it down. That figure is your reality, not your provider's.
4. Record who did it and when. If it is not written down, it does not exist.

RTO and RPO in business language

• RPO (how much data you can lose): if you copy every night, you can lose up to a day of work. Can you afford that in billing? And in email?
• RTO (how long you can be down): if restoring everything takes three days, that is your real downtime. Does your company survive three days without systems?

Those two numbers should be decided by management, not by the on-call IT person at three in the morning. And they should drive the frequency and type of backup.

Typical mistakes we see

• Backups reachable with work credentials: ransomware encrypts them along with everything else.
• A single medium in the same building: a fire, a theft or a power fault takes both original and copy.
• Encryption keys stored on the same server as the backup.
• No backup of email or databases, only the shared folder.
• No historical retention: if encryption happens in August and you only keep seven days, the good copy has already been overwritten.

A minimum plan for an SME

1. Inventory what data exists and which is critical.
2. Decide RPO and RTO per system, with management in the room.
3. Automatic daily backups, with external or immutable storage.
4. A quarterly restore test, with a written record.
5. Backup credentials different from work credentials, with no access from the user network.
6. One page with the procedure: who calls whom, and in what order.

Your next step

Backups are plan B. Plan A is not getting encrypted at all: closing remote access, enabling two-factor and patching what is visible from the internet.

To know where to start, our free OSINT audit shows what your company looks like from the outside within 72 hours, without touching your systems. And if you want to test how your network holds up to a real attack, we do that with penetration testing authorised in writing.