3.5Backup & restore
Everything else in IT is undone by one bad day if the data is gone. Backups are the safety net — but only if they are done right and, crucially, tested. The classic rule is 3-2-1: keep 3 copies of your data, on 2 different kinds of media, with 1 copy off-site. Three copies survive multiple failures; two media types survive a whole class of failure (all your disks, say); and an off-site copy survives a local disaster like fire, theft or flood.
Two refinements make it robust. First, keep at least one copy offline or immutable (disconnected), because ransomware will happily encrypt every backup it can reach over the network. Second — and this is where most backup strategies fail — test the restores. A backup you have never restored is a hope, not a guarantee: media fails silently, jobs stop running unnoticed, and files can be incomplete. Periodically restoring a sample proves the whole chain works. Decide backup frequency by how much data you can afford to lose, and match effort to the value of each dataset. Done well, backup is the last line of defense that turns a catastrophe into an inconvenience.
Section vocabulary
- Backup
- A copy of data kept so it can be recovered after loss, corruption or attack.
- 3-2-1 rule
- Keep 3 copies, on 2 media types, with 1 off-site.
- Offline / immutable copy
- A disconnected or unchangeable copy that ransomware cannot reach or alter.
- Restore test
- Actually recovering from a backup to prove it works — the step most often skipped.
- Backup frequency
- How often you back up, driven by how much recent data you can afford to lose.
Which rule sums up a good backup strategy?
In practice — Design a real backup plan
- Pick a dataset that matters and decide how much recent data you could afford to lose.
- Design a 3-2-1 scheme for it: three copies, two media types, one off-site.
- Add at least one offline or immutable copy to survive ransomware.
- Schedule a restore test and actually recover a sample file to confirm the chain works.
Key takeaways
- 3-2-1: three copies, two media types, one off-site.
- Keep at least one copy offline or immutable — ransomware encrypts everything it can reach.
- A backup never restored is worthless — test restores regularly.
- Set frequency by how much recent data you can afford to lose; match effort to data value.
Frequently asked questions
Why isn't one backup copy enough?
Because a single copy shares fate with the very things that destroy data. One copy on the same disk dies with that disk; one copy in the same building burns, floods or is stolen with the original; one online copy is encrypted along with everything else by ransomware. The 3-2-1 rule breaks these single points of failure: multiple copies survive individual failures, different media survive a whole failure class, and an off-site copy survives a site-wide disaster. Adding an offline or immutable copy closes the ransomware gap. Each layer is cheap compared with the cost of permanent data loss, which is why the rule endures.
My backups run automatically — isn't that enough?
Automation is necessary but not sufficient, because backups fail silently. Jobs stop running after a change and no one notices, media degrades, storage fills up, or files are captured mid-write and are unusable — and none of this shows until the day you desperately need to restore. The only proof that a backup works is a successful restore. Periodically recovering a sample — a few files, or a full system in a test — verifies the entire chain end to end and surfaces problems while they are still harmless. « It ran successfully » is a status message; « I restored it » is the guarantee.