The 3-2-1 backup rule everybody repeats is lacking a step, and I discovered the arduous method

If you have ever regarded into how to properly back up your important files, chances are high somebody pointed you to the 3-2-1 backup rule. Keep three copies of your information, retailer them on two totally different media varieties, and hold one copy offsite. It’s easy, straightforward to recollect, and nearly each backup information on the web recommends it. I adopted this rule for years, and I used to be assured my recordsdata have been secure. However, once I wanted to revive a backup, I found that the recordsdata I’d been dutifully copying for months have been corrupted. The backup existed, positive, however it was ineffective.

The 3-2-1 rule has a spot that most likely does not get the form of consideration it ought to. The rule tells you what number of copies to make and the place to place them, however it says nothing about checking whether or not these copies work. A backup is simply nearly as good as its restore course of, and with out common testing and verification, you are simply hoping for the perfect.

3-2-1 solely counts copies

The hottest backup rule focuses on amount, not high quality

The 3-2-1 rule has been round for a very long time. Photographer Peter Krogh first popularized it in his 2009 ebook on digital asset administration. He created it to guard his personal picture archives, and the logic was that three complete copies of your information (the unique plus two backups), saved throughout two several types of media (say, an exterior arduous drive and a cloud service), with not less than one copy stored offsite, is sufficient to defend towards fireplace, flood, or theft.

The logic itself is just not unhealthy. If your laptop computer dies, you may have an exterior drive. If your own home floods and takes each the laptop computer and the drive, you continue to have an offsite copy within the cloud. Each layer covers a distinct form of failure, which is why the rule has survived for over a decade and nonetheless will get really useful in every single place.

However, it solely counts copies. It assumes that when you’ve got your information in three locations on two media varieties with one offsite, you are coated. What it does not deal with is whether or not any of these copies might be restored to a working state. You might comply with 3-2-1 to the letter and nonetheless be in bother in case your backup recordsdata are corrupted, incomplete, or saved in a format you possibly can not learn.

When a backup is just not a backup

If you have by no means examined a restore, you do not have a backup plan

The lacking step that may flip 3-2-1 from a great behavior into an entire technique is verification and testing. If you are not frequently checking whether or not your backups might be restored, you may have recordsdata sitting on a drive someplace, however not essentially a backup plan.

When backup software program studies a profitable job, all it confirms is that information was copied with out an error the software program seen. What it does not affirm is that the information might be learn again, that it is full, or that it’ll flip right into a working system whenever you want it. Files get corrupted throughout transfers and storage media degrades over time. Incremental backup chains break in order that later backups rely on items that not exist. None of this reveals up till you attempt to restore one thing.

Backblaze’s 2024 Backup Awareness Survey, carried out by The Harris Poll with over 2,000 US adults, discovered that 84% of laptop house owners say they’ve backed up their information, but fewer than 1 in 5 (15%) really feel completely sure their most vital recordsdata are securely backed up. That’s a large confidence hole, and it tells you that most individuals know they need to again up, and plenty of do, however only a few have examined whether or not their backups work.

A easy repair includes choosing a random file or folder out of your backup and restore it. Open the recordsdata, affirm they’re intact, and ensure your backup instrument can discover and retrieve them with out errors. And that ought to shut the most important gap within the 3-2-1 rule.

One copy ought to keep unreachable

Modern threats imply not less than one backup must be untouchable

If all of your copies are reachable from the identical community with the identical login credentials, a single ransomware assault can wipe out every thing, together with the unique information and each backup.

So, we now have an up to date rule: 3-2-1-1-0. The two new numbers deal with the threats that the unique rule missed. The further “1” means preserving not less than one immutable or air-gapped copy. Immutable means the information cannot be modified or deleted for a set interval, not even by an admin. Air-gapped, however, means the backup is bodily disconnected from the community, like a drive you unplug after every backup or a tape you retailer offsite. Either method, the objective is identical: one copy that ransomware or a compromised account cannot contact. Tools like FreeFileSync can create an exact mirror of your files on a disconnectable drive, which you’ll then unplug and retailer individually.

The “0” stands for zero errors, verified. This is the place the testing step will get baked into the rule itself. Instead of treating verification as non-obligatory, 3-2-1-1-0 makes it a requirement. You obtain zero errors via common integrity checks and restore practices. CISA, the US Cybersecurity and Infrastructure Security Agency, has famous that many organizations solely uncover their restores fail throughout an precise incident, which is the worst doable time to be taught that lesson. Running a take a look at restore each quarter, or automating checks in your backup recordsdata, is a greater method to ensure your information is secure.

The 3-2-1 backup rule continues to be customary, with one replace

The model of the rule I comply with now could be 3-2-1-1-0, and it is not a lot more durable to arrange than the unique. The distinction is that when one thing goes improper, I’ll know my backups work as a result of I’ve already examined them, not as a result of I assumed they might.