Cyber Academy
Backups that survive ransomware
The 3-2-1 rule, why a synced cloud folder is not a backup, and how to test a restore before you need one.
A backup only counts if it survives the event you are backing up against. Ransomware is the clearest test, because it deliberately targets connected copies.
The 3-2-1 rule
Three copies of the data, on two different types of media, with one copy kept offsite. It predates cloud storage but maps onto it cleanly: the working copy, a local external drive, and a cloud or offsite copy.
Sync is not backup
A synced folder faithfully replicates deletion and encryption. If ransomware encrypts your files, the sync client dutifully uploads the encrypted versions. Versioning helps, but only if retention is long enough and you notice in time.
A real backup is either offline or immutable — a drive you disconnect, or storage with versioning the client cannot overwrite.
Test the restore
An untested backup is a hypothesis. Once a quarter, restore a handful of files to a different location and open them. Most backup failures are discovered during the emergency, which is the worst possible time.
Practice task
Use the Backup Planner to map your current copies against the 3-2-1 rule and export the resulting checklist.