Backups That Survive Ransomware: The 3-2-1 Rule

Dr. Al-Doori puts backups first in his list of defenses for a simple reason: if you have a good copy of your files, even a total infection, a stolen laptop or a dead hard drive becomes survivable. This lesson turns that advice into a concrete plan you can build and test this week.

What you'll be able to do

Design and test a 3-2-1 backup plan for your own files. By the end of this lesson you will be able to:

• explain the 3-2-1 rule and why one copy should be kept offline;
• tell the difference between syncing and backing up, and why it matters during a ransomware attack;
• write a simple backup plan for your own files and test that you can actually restore from it.

The 3-2-1 Rule

A backup is a separate copy of your files that you can use to get them back if the originals are lost, damaged or locked. CISA, the US national cyber agency, recommends a simple pattern called 3-2-1:

• 3 copies of your important data: the original plus at least two backups;
• on 2 different types of storage, for example your laptop's drive and an external drive, or an external drive and a cloud backup service;
• with 1 copy offsite, somewhere physically separate, so a fire, flood or burglary cannot take every copy at once.

Each number protects against a different failure. Three copies protect you if one backup turns out to be faulty. Two types of storage protect you because different media fail for different reasons. One offsite copy protects you from disasters that affect a whole building.

Keep One Copy Offline

Ransomware changes the picture. As you saw in Lesson 5.2, ransomware tries to encrypt every drive and folder it can reach. A backup drive that is always plugged in can be encrypted along with everything else. The FBI's advice is to make sure backups are not connected to the computers and networks they back up.

In practice, this means at least one copy should be offline: an external drive that you plug in to run the backup, then unplug and put away. Some people use two drives and swap them, so one is always disconnected. So a modern version of the rule is: 3-2-1, with at least one copy offline.

Sync Is Not Backup

Many people believe their files are backed up because they use a cloud storage service that keeps a folder on their laptop and the cloud in step. That is sync, and it is useful, but it is not the same as a backup.

Sync copies changes, whatever they are. If you delete a file, the deletion syncs. If ransomware encrypts your files, the encrypted versions can sync up to the cloud too, and the UK's National Cyber Security Centre (NCSC) reports incidents in which ransomware compromised connected cloud storage. A backup, by contrast, is a separate copy that does not automatically change when your originals do.

Sync is a great convenience for working across devices. Just don't count it as one of your three copies unless you are sure it keeps separate copies that a problem on your laptop cannot overwrite.

Test a Restore

A backup you have never restored from is a hope, not a plan. Backups can fail silently: a drive dies in a drawer, a setting skips a folder, or a service stops running months ago without you noticing. Current guidance, including the #StopRansomware Guide from CISA and its partners, is to test restores: every so often, pick a few files and actually bring them back from each backup. If you can open them, your backup works. If you can't, you have found the problem on a calm day instead of during a crisis.

Don't forget your phone. It often holds your only copy of photos and messages, and its backup setting is worth checking too (Lesson 5.6).

Try It: Design Your 3-2-1 Plan

Work on this privately, on paper or in a note on your own device. Describe types of storage, not account names, email addresses or passwords. If you are ever asked to submit anything, a completion confirmation is enough.

1. List what matters. Which files would hurt most to lose? Typical answers: photos, study or work documents, personal records.
2. Find your copies today. For each item, where does it live now? Count real copies, and remember that a synced folder alone does not count as a separate backup.
3. Fill the gaps. Plan how you will reach 3 copies on 2 types of storage with 1 offsite and 1 offline. For example: originals on the laptop; a weekly backup to an external drive that is unplugged afterwards; a cloud backup service as the offsite copy.
4. Set a rhythm. Decide how often each backup runs, and put a reminder in your calendar for the manual ones.
5. Test it. Restore two or three files from each backup and open them. Note the date you tested.

Real-World Example

In Lesson 1.3 you met Mat Honan, the journalist whose linked accounts were taken over in 2012. In his own account of the attack, Honan describes how the attackers used his Apple ID to remotely erase his iPhone, iPad and MacBook, and how more than a year of photos covering his young daughter's life was lost.

The attack itself was account takeover, not ransomware, but the lesson for this unit is the same. Those photos had no copy that the attackers could not reach. One offline backup drive, sitting unplugged in a drawer, would have turned an irreplaceable loss into an inconvenience: exactly the outcome Dr. Al-Doori describes when he puts backups first.

From the Book to 2026

What the book teaches. Dr. Al-Doori advises copying important files and keeping the copies somewhere safe, away from your computer, using options such as external hard drives, flash memory, optical discs or cloud storage. With good backups, even a total infection is survivable.

Why it made sense. Storage is cheap and copies are the surest way to recover from loss, which remains true today.

What has changed. Security guidance has evolved since the original text. CISA now recommends the more specific 3-2-1 rule. Ransomware deliberately targets connected backups, so the FBI advises keeping backups disconnected. Cloud sync has become common, but because it copies every change, it can spread damage to your cloud files rather than protect you from it; the NCSC has seen ransomware compromise connected cloud storage.

What to do now. Current guidance now recommends three copies, on two types of storage, with one offsite and at least one offline; not counting sync as a backup; and testing restores regularly. Remember too, from Lesson 5.2, that backups restore your files but not your privacy if data was stolen.

Watch: Data Backup: The 3-2-1 Rule

This short video from ExplainingComputers explains the 3-2-1 rule in plain language, with practical examples, and ends on the same ransomware warning this lesson gives.

As you watch, notice:

• the presenter's reminder that every kind of storage fails eventually, from hard drives and SSDs to flash drives and optical discs, which is why one copy is never enough;
• his story of backups kept in a locked box right next to the computer they protected, and why that defeats the purpose of an offsite copy;
• his addition to the rule: the offsite copy should be isolated, because an automatic online backup can copy encrypted files over your good ones.

The video reinforces what you just read — the lesson is complete without it.

What Would You Do?

A classmate says: "I don't need backups. Everything on my laptop is synced to the cloud automatically." Their thesis, photos and coursework all live in that synced folder. What would you tell them, and what is the smallest change that would make them much safer?

Knowledge Check

Key Takeaways

• 3-2-1: three copies, on two types of storage, with one offsite.
• Keep at least one copy offline, because ransomware attacks any backup it can reach.
• Sync is not backup: it can copy deletions and encrypted files over your good ones.
• Test a restore regularly; an untested backup is only a hope.
• Backups restore your files, but not your privacy.

Sources

• US-CERT / CISA — Data Backup Options
• CISA, FBI, NSA and MS-ISAC — #StopRansomware Guide
• FBI Internet Crime Complaint Center (IC3) — Ransomware
• UK NCSC — Offline backups in an online world (2019)
• Mat Honan's 2012 account of the attack, as reposted (ISN mailing list)
• Dr. Tahseen Al-Doori — Cyber Security Essentials, Chapter 16