Lessons · Cybersecurity · backups and the 3-2-1 rule

Backups and the 3-2-1 rule

Keep three copies of the data, on two different kinds of storage, with one copy somewhere else, and treat a backup you have never restored from as a hope rather than a backup.

Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.

What it is for

The ransomware encrypted the file server, then found the backup drive plugged into it and encrypted that too. The company that recovered in a day had a copy offline in another building. The company that paid did not.

How to think about it

Count the copies and where they are. Three including the live data. Two kinds of storage, so one fault cannot take both. One offsite or offline, so fire, theft or ransomware in the building cannot reach it. Then restore something every month and write down how long it took.

Worked example

Copy 1: the live data on the server

It counts as one of the three.

Copy 2: nightly backup to an appliance in the rack

Second copy, second kind of storage, same building.

Copy 3: weekly copy offsite, with its own separate credentials

The one that survives the building, and that a stolen password cannot delete.

Restore test: pick a file, restore it, time it, write down 9 minutes

Now it is a backup. Before the test it was a folder with a hopeful name.

Your turn

In the 3-2-1 rule, write the number of copies that must be kept away from the main site.

copies kept offsite:

The trap

A backup that is permanently connected to the machine it protects. Anything that can encrypt the server can encrypt a drive plugged into it.

Practise backups and the 3-2-1 rule on HoneA question on it now, a coding challenge where there is one, and it is remembered for review. Free, no email needed.