The 3-2-1 Backup Rule: Your Insurance Against Ransomware

Ransomware encrypts your files and demands payment for the decryption key. Antivirus software, MFA, and careful browsing all reduce the odds of infection, but none of them guarantee it won't happen. The single control that determines whether a ransomware infection is a minor inconvenience or a catastrophe is whether you have backups that the ransomware couldn't also reach and encrypt.

The 3-2-1 rule

This is a decades-old backup principle that has aged well specifically because it accounts for ransomware and hardware failure alike:

• 3 copies of your data — the original plus two backups.
• 2 different storage media or systems — for example, an external drive and a cloud service, not two folders on the same laptop.
• 1 copy stored off-site or offline — physically disconnected from your network, or in a separate cloud account the ransomware process can't authenticate into.

That last point is the one people skip, and it's the one that matters most against ransomware specifically. If your "backup" drive is permanently plugged in and mapped as a network drive, ransomware that encrypts your main files will typically encrypt that backup too. A true off-line or off-site copy is immune because the malware simply can't reach it.

Practical setup for individuals

1. Use your operating system's built-in backup tool (or a reputable third-party one) to back up to an external drive, and disconnect that drive when the backup finishes.
2. Use a cloud backup service with file versioning, so that even if synced files get encrypted, you can roll back to a version from before the infection.
3. For anything irreplaceable — family photos, financial records, tax documents — keep an additional archived copy somewhere entirely separate, updated a few times a year.

Backups you never test aren't backups

An untested backup is a hope, not a plan. Periodically restore a handful of files from each backup source to confirm the process actually works end to end. Discovering a backup was silently failing is far better done during a routine check than during an actual recovery.

If it happens anyway

Disconnect the infected device from the network immediately to stop encryption from spreading to shared drives. Don't pay the ransom as a first move — payment doesn't guarantee you get usable keys back, and it funds further attacks. Restore from your most recent clean backup instead, and only after confirming the infection vector has been closed.

A solid backup strategy turns ransomware from an existential threat into a bad afternoon spent restoring files.