The 3-2-1 Backup Rule: The Most Effective Defence Against Ransomware

Ransomware encrypts your data and makes it inaccessible, then demands payment for the decryption key. The single most effective defence against this threat is not an advanced detection product but a solid backup: if you have an intact copy of your data, you can recover without paying. But not every backup works — ransomware encrypts the backups it can reach. That is why the architecture of the backup matters.

The 3-2-1 rule

A simple rule that has been the standard for a long time:

• 3 copies: production data plus at least two backups.
• 2 different media/types: backups should not all live on one technology (e.g., local disk + cloud).
• 1 copy off-site: at least one backup in a physically or logically separate location.

This protects against both hardware failure and a single event (fire, ransomware) destroying all copies.

The ransomware addition: immutable and offline backups

Modern ransomware targets network-connected, writable backups too. So two modern additions are made to 3-2-1:

• Immutable backups: Backups marked unchangeable and undeletable for a set period. Even if an attacker gains admin access, they cannot encrypt or delete these.
• Air gap / offline copy: A copy disconnected from the network is a safety net the attacker cannot reach.

This is sometimes extended to “3-2-1-1-0”: one immutable/offline copy, and 0 errors in restore testing.

The most critical step: test your restores

An untested backup is not a backup. You must know in advance that your backup can actually be restored.

• Run regular restore drills.
• Measure your recovery time (RTO) and acceptable data loss (RPO).
• Periodically verify backup integrity.

Summary

The most reliable defence against ransomware is a solid backup: the 3-2-1 rule, plus an immutable and offline copy, and regular restore tests. Recovering from a clean copy instead of paying is both the cheapest and the most reliable way out.

Sources: CISA StopRansomware, NIST cybersecurity resources.

The main defence against ransomware is backups, but the attack usually begins with a gap in your external surface. CyberTestify’s scan makes that initial entry surface visible.