Backups and Resiliency

One Monday the shop PC shows a message: every file is encrypted, pay to get them back. Whether this is a bad day or the end of the business depends almost entirely on one question asked long before: do we have a backup the attacker could not reach?

The rule

Three copies, two kinds of storage, one away from the building, and test restoring.

This is the 3-2-1 rule, with a fourth part people forget:

• 3 copies of important data: the live data plus two backups.
• 2 different kinds of storage, such as an external drive and a cloud backup service, so one failure type cannot take both.
• 1 copy off-site, so a fire, flood or theft at the shop does not destroy everything.
• Test restores regularly. A backup you have never restored is a hope, not a plan.

For ransomware, add one more requirement: at least one copy must be offline or immutable (cannot be changed or deleted for a set time). Ransomware encrypts every drive it can reach, including a backup drive left plugged in.

Resiliency is the broader goal: staying able to work, or getting back quickly, when something fails. Two questions define it for each system:

• How much recent data can we afford to lose? That sets how often to back up.
• How long can we be down? That sets how fast the restore must be.

The shortcut

For each important system, ask "If it vanished right now, where exactly would I restore it from, and when did I last try?" If you cannot name the copy and the date, fix that first.

The trap is a "backup" that is just a sync. A synced folder copies deletions and encryption almost instantly, so it protects against a broken laptop, not against ransomware or mistakes.

Drills

Answer fast — trust the rule.

Remember

• Three copies, two kinds of storage, one off-site, and test restoring.
• Keep one copy offline or immutable against ransomware.
• Ask "where would I restore from, and when did I last try?" Trap: calling a sync a backup.