Ransomware crews stopped playing nice years ago. They no longer just encrypt your files and wait for a wire transfer. Modern operators hunt for your backups first, delete or encrypt them, then flip the switch on your production data. If your only backup lives on a NAS that's mounted 24/7 on the same network, congratulations: you've built the attacker a convenient two-for-one deal.
Here's the stat that should keep you up at night. According to multiple incident-response reports over the past few years, attackers successfully compromise backup repositories in roughly 70% of ransomware cases where they gain domain-level access. That's the difference between "we restored in four hours" and "we paid the ransom and still lost three weeks of data." The single most reliable defense against that outcome is old, boring, and battle-tested: the 3-2-1 backup strategy.
In this guide I'll walk you through what 3-2-1 actually means, how to modernize it for the ransomware era with the "3-2-1-1-0" extension, a worked example with real storage numbers and costs, a comparison of backup destinations, and a step-by-step build you can start today. I've run this exact setup for my own sites and a handful of small business clients, so this is what I actually do, not a whitepaper fantasy.
Key Takeaways
- The 3-2-1 rule means 3 copies of your data, on 2 different media types, with 1 copy offsite.
- To survive ransomware specifically, extend it to 3-2-1-1-0: add 1 immutable or air-gapped copy and 0 verified restore errors.
- Immutability (write-once, delete-locked storage) is now the single most important upgrade you can make.
- An untested backup is a rumor. Schedule real restore drills at least quarterly.
- Keep at least one copy fully disconnected from your network and credentials the attacker can reach.
- Encrypt every copy, and store the encryption keys somewhere the ransomware can't touch.
What the 3-2-1 Backup Strategy Actually Means
The 3-2-1 rule was popularized by photographer Peter Krogh, who needed a simple, memorable formula for never losing an image. It stuck because it's dead simple to explain and surprisingly hard to argue with.
- 3 copies of your data. Your live production data counts as copy number one. You then need two more backups. Three copies means it takes three independent failures to lose everything, and independent failures are rare when the copies are genuinely separate.
- 2 different media types. Don't put both backups on identical drives from the same batch. Spread across SSD, HDD, cloud object storage, or tape. Different media fail in different ways, so you're not betting the farm on one technology's failure mode.
- 1 copy offsite. A fire, flood, theft, or a burst pipe in the server room doesn't care how many local copies you have. One copy needs to physically live somewhere else.
That's it. The genius is in the redundancy math. If each copy has, say, a 5% annual chance of being lost, three properly independent copies push the odds of losing all three to roughly 0.0125% per year. That's the kind of margin that lets you sleep.
Why plain 3-2-1 isn't enough against ransomware
The classic rule was designed for hardware failure and human error, not adversaries who actively hunt your backups. If all three copies are reachable over the network with the same admin credentials, a single compromised account can wipe all three. Ransomware turned the "offsite copy" from a nice-to-have into a survival requirement, and then made even that insufficient unless the copy is immutable or air-gapped.
The Modern Upgrade: 3-2-1-1-0 for the Ransomware Era
Backup vendors and incident responders now recommend extending the rule with two extra digits. It looks intimidating but the additions are straightforward.
- +1 immutable or air-gapped copy. One backup that literally cannot be altered or deleted for a set retention window, even by an administrator. This is your last line of defense. When everything else is encrypted, this copy stands.
- +0 restore errors. Zero errors on verification. A backup you've never tested restoring is a guess. This digit forces you to prove your backups actually work.
What "immutable" really means
Immutability is write-once-read-many (WORM) at the storage layer. Cloud providers implement it as Object Lock on S3-compatible storage. Once you write an object with a 30-day lock, nobody, not even the root account holder, can delete or overwrite it for 30 days. Ransomware running with your credentials hits a wall.
Air-gapping is the physical version: a backup on a drive or tape that is disconnected from any network. If it's unplugged, it can't be encrypted. The tradeoff is that someone has to physically rotate media, which is fine for a small shop but tedious at scale.
A Worked Example: Backing Up a Small Business in Numbers
Let me make this concrete. Say you run a small agency with the following data footprint:
- Production web servers: 3 WordPress sites and 1 PrestaShop store, roughly 40 GB total including databases and uploads.
- Office file share: contracts, design files, invoices, about 500 GB and growing 5% per month.
- Developer machines: 4 laptops, but only the code repos matter and those live in Git, so we count them as covered.
Total meaningful data: about 540 GB. Here's how I'd map 3-2-1-1-0 onto it.
- Copy 1 (production): the live data itself, on your servers and workstations.
- Copy 2 (local, fast restore): a nightly backup to a dedicated NAS with two 4 TB drives in RAID 1. Media type: spinning HDD. Restore time for the 40 GB of web data over gigabit LAN: about 6 minutes. This is your everyday "oops I deleted the wrong folder" recovery.
- Copy 3 (offsite cloud, immutable): nightly upload to S3-compatible object storage with a 30-day Object Lock. At roughly $6 per TB per month, 540 GB costs about $3.20/month in storage, plus modest transfer fees. Media type: cloud object storage. This is both your offsite copy and your immutable copy.
- Copy 4 (air-gapped monthly): a monthly full backup to a USB drive that gets unplugged and locked in a drawer, rotated between two drives. Cost: two 1 TB external SSDs, about $120 total, one-time.
For under $130 up front and roughly $4/month ongoing, this agency now has four copies, three media types, an offsite copy, an immutable copy, and an air-gapped copy. A ransomware crew that compromises the domain admin can trash the NAS, but the Object Lock holds and the USB drive was never even connected. That's a survivable incident instead of a business-ending one.
Where to Store Your Copies: Comparing Backup Destinations
The hardest decision most people face is where the copies live. Each destination has a different profile for cost, speed, and ransomware resistance. Here's how the main options stack up.
| Destination | Restore Speed | Ransomware Resistance | Rough Cost | Best For |
|---|---|---|---|---|
| Local NAS (RAID) | Very fast | Low (network-reachable) | $$ upfront | Daily quick restores |
| External USB drive (air-gapped) | Fast | Very high when unplugged | $ upfront | Air-gapped monthly copy |
| Cloud object storage + Object Lock | Moderate | Very high (immutable) | $ per month | Offsite + immutable copy |
| Cloud sync (Dropbox/Drive) | Fast | Low (syncs encryption too) | $ per month | Convenience, NOT backup |
| LTO Tape | Slow | Very high (air-gapped) | $$$ upfront | Large archives, compliance |
One warning that catches people out: cloud sync services are not backups. If ransomware encrypts a file in your synced folder, Dropbox happily syncs the encrypted version to the cloud and to every other device. Versioning can sometimes save you, but retention is short and it's fiddly to restore hundreds of files. Treat sync as convenience, never as your recovery plan.
How to Build Your 3-2-1 Backup: A Step-by-Step Walkthrough
Here's the actual build sequence I follow. Adjust the tooling to your platform, but the order matters: define scope first, then automate, then verify.
Step 1: Inventory what you actually need to protect
List every source of irreplaceable data: databases, uploaded media, configuration files, email, and documents. Assign each a Recovery Point Objective (how much data you can afford to lose, in hours) and Recovery Time Objective (how fast you need it back). A live e-commerce database might need an RPO of 1 hour; a marketing archive can tolerate 24 hours.
Step 2: Set up the local copy first
Configure nightly backups to your NAS or a second internal drive. For WordPress and PrestaShop, back up both the files and the database dump. Use a dedicated backup account with the minimum privileges needed, never your daily-driver admin login. If you run WordPress, harden the site itself so it's not the entry point in the first place; tools like eDarpan WordPress Protection and a full-stack option such as SiteGuard Pro reduce the odds you ever need those backups.
Step 3: Push an offsite immutable copy to the cloud
Create an S3-compatible bucket and enable Object Lock in compliance mode with a retention period at least as long as it typically takes you to notice an intrusion, so 30 days minimum. Compliance mode is stricter than governance mode: even the root user cannot shorten the lock. Configure your backup tool to upload nightly. Use a bucket-specific access key, not your master
Cover image: MCLI Server 'Farm' by cogdogblog, licensed under CC0 1.0 via Openverse.
