A disk failure, ransomware or a fire... If you have a backup, your business keeps running. But does your backup really work? Test your backup plan with one simple rule.
One morning a server disk fails, an employee deletes the wrong folder, or a message appears on screen: "your files have been encrypted". At that moment, the only thing that decides how quickly your business gets back on its feet is your backup. Most companies take backups; the real question is whether that backup actually works when you need it.
The most practical way to test your backup plan is a simple rule that has been around for years: 3-2-1.
What is the 3-2-1 rule?
3 copies
Keep three copies of your data in total: the original and two separate backups. A single backup can turn out to be corrupt, incomplete or outdated on exactly the day you need it.
2 different media
Don't keep the backups on the same type of device. For example, one copy on an on-site storage device (NAS) and the other in the cloud or on an external disk. Two devices of the same type can fail for the same reason, at the same time.
1 copy off-site
Keep at least one copy outside the office. A fire, flood or theft takes the server and the backup disk in the same room together. Cloud backup, or a copy regularly moved to another location, closes this gap.
The original data is on the server; every night a backup goes to the on-site storage device; a copy of the same backup is encrypted and sent to the cloud. That makes three copies, on two different media, with one copy off-site.
How ransomware changed the rule
Ransomware tries to encrypt not only the original data but also any backup it can reach over the network. That is why two items are now usually added to 3-2-1:
- At least one copy should be offline or immutable. A disk disconnected from the network, or a cloud backup that can't be deleted for a set period (immutable), stays safe even while an attacker is inside.
- Zero errors on restore. The backup should be verified and tested to actually restore.
Some sources call this extended version 3-2-1-1-0.
Commonly overlooked points
Never testing a restore
A backup that won't open is not a backup. At regular intervals, restore a file, a database or even a whole server from backup and check it. Note how long it took; knowing this in a real outage makes planning much easier.
Relying on one person's memory
Manual backups get forgotten one day. Schedule your backups and set up a notification so someone knows when one fails.
Not knowing what is backed up
The file server may be backed up while the database, email, firewall and server configurations are left out. For the cloud applications you use, check in the contract who holds the backup of your data.
Sharpen your plan with two questions
- How much data loss can you accept? If losing a day's records is acceptable, a daily backup may be enough; if not, you need more frequent backups.
- How quickly must you be back in business? If even a few hours of downtime stops your work, a plan for fast recovery from a local copy is essential.
The answers decide how often backups are taken and where they are kept.
Checklist
- There are at least three copies of the data.
- The copies are on at least two different types of media.
- At least one copy is off-site.
- At least one copy is offline or immutable.
- Backups are automatic and failures send a notification.
- Restores are tested at regular intervals.