The 3-2-1 backup rule, updated for ransomware

What is the 3-2-1 backup rule?

For decades, the 3-2-1 backup rule has been the gold standard for data protection. The concept is simple: you keep three copies of your data, on two different media types, with one copy stored offsite. This strategy was designed to protect against hardware failure, theft, or natural disasters like fire or flood. If your office server failed, you had a local backup. If the office burned down, you had an offsite copy. It was a reliable framework for an era where the main threats were physical or mechanical.

However, the threat landscape has changed drastically with the rise of cybercrime. Ransomware is now the primary threat to small business data, and it is designed to seek out and destroy every backup it can reach. Attackers know that if they can delete your backups, they have total pressure over you. This means the classic version of the 3-2-1 backup rule needs an update for the modern era. We can no longer assume that a backup is safe just because it is 'offsite.'

For a small business owner, following an outdated backup strategy is like wearing a life jacket that doesn't float. It gives you a false sense of security until the moment you actually need it. This article explains how to modernize your approach to ensure your business can survive a ransomware attack.

Why ransomware changes the rules of data protection

Traditional backups were often 'always-on' and connected to the network. This allowed for easy, automated updates that happened in the background. But if ransomware infects your network, it can travel through those same connections to encrypt your backups just as easily as it encrypts your live files. If your offsite copy is just a cloud drive like Dropbox or OneDrive that is mapped to your computer, the ransomware will find it and lock it.

To counter this, the updated 3-2-1 backup rule adds a new, critical requirement: immutability or air-gapping. An immutable backup is a copy of your data that cannot be changed, modified, or deleted for a specific period, even if an attacker gets your administrator password. An air-gapped backup is one that is physically disconnected from the network when not in use, making it impossible for ransomware to reach it through the wire.

Modern attackers often spend days or weeks inside a network before they launch the ransomware. During this time, they look for backup servers and delete the restore points. If your backup system isn't designed to resist this, you will find yourself with 'successful' backup logs but no actual data to restore.

The updated 3-2-1-1-0 strategy explained

Security experts now often refer to the 3-2-1-1-0 rule as the new minimum standard for small businesses. This expanded version provides the level of protection needed in a world where backups are a primary target:

• 3: Keep at least three copies of your data (the primary data and two different backups).
• 2: Store the backups on two different media types (for example, a local disk array and a cloud-based service).
• 1: Keep at least one backup copy offsite, away from your physical office.
• 1: Keep at least one backup copy offline, air-gapped, or in an immutable storage format that cannot be deleted by an attacker.
• 0: Ensure there are zero errors after daily backup verifications and regular recovery testing.

By adding that second '1' (immutability) and the '0' (verification), you close the loop on the most common ways that backups fail during a disaster. You are no longer just 'backing up'; you are ensuring 'recoverability.'

Implementing the rule in a small business budget

You do not need an enterprise-sized IT budget to follow the 3-2-1 backup rule. Most modern cloud backup services designed for small businesses now offer 'Object Lock' or 'Immutable Storage' options. This feature allows you to set a policy where data written to the cloud cannot be deleted for a set period, such as 30 or 60 days. Even if an attacker enters your network and tries to wipe your cloud backups, the cloud provider's system will simply block the request.

Another affordable option is using 'rotating drives' for your local backup. By having three external hard drives and taking one home each night, you create a physical 'air gap.' While this requires more manual effort than a cloud-only solution, it provides a layer of protection that no hacker can bypass digitally. The key is to find a balance between automation and security that your team can actually maintain.

Testing is not optional for the 3-2-1 backup rule

A backup that has never been tested is not a backup; it is just a hope. Many businesses have discovered too late that their backups were failing silently for months because of a simple configuration error, or that the recovery process takes days when they only have hours to get back to work. Regular testing is the only way to fulfill the '0' in the 3-2-1-1-0 rule.

Testing should involve more than just checking a log file for a green checkmark. You need to actually restore data and ensure it is usable. Start small by restoring a single folder, then once a year, try to restore an entire server to a virtual environment. This practice not only proves the technology works but also ensures your team knows exactly what to do when the pressure is on.

1. Perform a file-level restore test every month to ensure individual files are readable.
2. Perform a full system restore test once a year to verify the entire server can be rebuilt.
3. Document how long the restoration process takes; this helps set realistic expectations for leadership.
4. Update your disaster recovery plan immediately based on any issues found during testing.

Common mistakes that break the 3-2-1 backup rule

One of the most common mistakes is relying solely on synchronization services like Dropbox, Google Drive, or OneDrive as a backup. While these are excellent for collaboration and remote work, they are not true backups. If a file is encrypted by ransomware on your computer, the sync service will immediately sync that encrypted version to the cloud, replacing your good copy with the broken one. True backups are 'versioned,' meaning you can go back in time to a version before the infection happened.

Another mistake is keeping all your backups on the same network without any isolation. If your backup server is just another computer on your 'Domain,' the ransomware will find it just like it finds your file server. Separating your backup network from your main user network is a fundamental part of the 3-2-1 backup rule.

• Do not use the same administrative account for your main network and your backup storage.
• Do not leave your local backup drives plugged in 24/7 if they do not support immutability.
• Do not ignore backup failure notifications; investigate every error immediately.
• Do not forget to back up your cloud-based data, such as Microsoft 365 email and SharePoint sites.

Building your modern backup roadmap

Modernizing your backup strategy can feel overwhelming, but you don't have to do it all at once. Start by auditing what you have today. Do you have at least one copy offsite? Is it protected from deletion? Once you have the basics in place, you can add layers like immutability and regular testing. The 3-2-1 backup rule is your best defense against data loss, but only if it evolves to meet today's threats. By following this updated plan, you ensure that no matter what happens to your hardware or your network, your business data remains safe and recoverable.