Backups that really restore: the 3-2-1 rule
Three copies, two types of storage, one off-site. And the step almost everyone skips: trying a restore.
When an attack encrypts your files, or a disk fails, the only thing that saves the company without paying is a backup that restores. The problem is that many companies only find out on the day of the attack that the backup doesn't work, or that it was encrypted along with everything else.
The 3-2-1 rule
- 3 copies of the data: the originals and two more.
- 2 different types of storage: for example, a disk at the company and a cloud service.
- 1 copy outside the company: if there's a fire or a theft, the data still exists.
The detail that makes the difference
A ransomware attack also looks for and encrypts the backups it can reach over the network. So at least one copy has to be disconnected (a disk you plug in only to make the copy, in rotation) or immutable (a cloud service where the copy can't be deleted or changed for a set period).
Try a restore
- 01 Pick an important folder (accounts, projects) and restore it somewhere else.
- 02 Open a few files and check they're complete and up to date.
- 03 Time how long it took: that's how long the company will be stopped in an attack.
- 04 Repeat every three months and write down the date you did it.