Ransomware operators have gotten smarter, and the first thing they hunt for is your backups. Not your files. Your backups. Because a company with a clean, recent, offline copy of everything simply doesn't pay. So the modern playbook is to sit quietly on a network for days or weeks, encrypt or delete every backup they can reach, and only then trigger the payload. By the time you notice, the safety net is gone.
Here's the stat that should keep you up at night: according to Sophos's State of Ransomware research, a large majority of ransomware incidents now include a deliberate attempt to compromise the victim's backups, and in a meaningful share of those cases the attackers succeed. Once your backups are toast, your only options are paying the ransom (with no guarantee of getting data back) or rebuilding from scratch.
The good news is that a properly implemented 3-2-1 backup strategy defeats this attack pattern almost entirely. The catch is that most people implement a broken version of it. In this guide I'll walk you through what 3-2-1 actually means, where it fails against ransomware, and the specific upgrades (3-2-1-1-0) that make it survivable. You'll get a worked example, a comparison of backup media, and a step-by-step build plan you can start today.
Key Takeaways
- 3-2-1 means: 3 copies of your data, on 2 different media types, with 1 copy offsite.
- The classic 3-2-1 model was designed for hardware failure and fire, not ransomware that actively hunts backups.
- Add 1 immutable or air-gapped copy and 0 backup errors (verified restores) to make it ransomware-resistant. This is called 3-2-1-1-0.
- The single most important upgrade is a copy attackers physically cannot reach or modify: offline drives, immutable object storage, or WORM media.
- Test restores on a schedule. An untested backup is a rumor, not a recovery plan.
- Automate the whole thing so it happens without you remembering. Manual backups fail because humans forget.
What Is a 3-2-1 Backup Strategy?
The 3-2-1 backup strategy is a data protection rule that's been the industry standard for over two decades. It breaks down into three simple numbers:
- 3 copies of your data — the original plus two backups. If one copy is corrupted or lost, you still have two more.
- 2 different media types — for example, an internal SSD and an external HDD, or local disk and cloud object storage. Using two types means a flaw that kills one medium (a bad batch of drives, a filesystem bug) won't kill both.
- 1 offsite copy — stored in a physically separate location. This protects you from fire, flood, theft, or a lightning strike that fries every device in one building.
It's elegant because it defends against the three most common data-loss causes: hardware failure, accidental deletion, and site-level disasters. For decades that was enough.
Why the Classic Model Is No Longer Enough
The problem is that ransomware breaks the assumptions 3-2-1 was built on. All three of your copies might be online and reachable from the same machine. If your PC is infected and it can write to your external drive and sync to your cloud folder, then all three copies get encrypted in one sweep. You technically had 3-2-1, and you technically lost everything.
Modern ransomware also targets network-attached storage (NAS) devices directly, deletes Windows Volume Shadow Copies with a single command, and abuses cloud sync so your poisoned files overwrite the good ones. This is why security-focused site owners increasingly pair backups with active hardening tools like SiteGuard Pro — because the fastest recovery is the incident that never lands in the first place.
Upgrading to 3-2-1-1-0: The Ransomware-Proof Version
The refinement that turns a fragile backup into a survivable one adds two more digits: 3-2-1-1-0.
- 1 (immutable or air-gapped): One of your copies must be impossible for a compromised machine to modify or delete. That means either physically disconnected (air-gapped) or write-locked (immutable / WORM).
- 0 (zero errors): Your backups must be verified with test restores so you have zero surprises during a real recovery.
That extra "1" is the whole game. Ransomware can only encrypt what it can write to. An offline drive sitting in a drawer, or an immutable S3 bucket with object lock enabled, is invisible to the malware. Even if every online copy is destroyed, that one untouchable copy brings you back.
Air-Gapped vs Immutable: What's the Difference?
Air-gapped means physically or logically disconnected. An external USB drive you plug in weekly, back up to, then unplug and store in a safe is air-gapped. Attackers cannot reach a drive that isn't connected.
Immutable means the storage itself refuses to allow changes or deletions for a set retention period. Cloud object storage with "object lock" or "WORM" (Write Once Read Many) is immutable. Even someone with your admin credentials cannot delete a locked object before its retention window expires.
Both work. Air-gapped is cheaper and dead simple; immutable is more automated and doesn't rely on you remembering to unplug a cable.
Choosing Your Backup Media: A Real Comparison
Your "2 different media types" decision matters more than people think. Here's how the common options stack up on the criteria that actually affect ransomware recovery.
| Media Type | Cost / TB | Ransomware Resistance | Restore Speed | Best For |
|---|---|---|---|---|
| External USB HDD (air-gapped) | Low ($15–25) | Excellent when unplugged | Fast (local) | Home users, small offices |
| NAS (always connected) | Medium | Poor unless snapshots + isolation | Very fast | Convenience, not primary defense |
| Cloud sync (Dropbox/Drive) | Medium | Poor (syncs poison too) | Medium | File sharing, not real backup |
| Cloud object storage (immutable) | Low–Medium ($5–15) | Excellent (object lock) | Medium (download time) | Offsite + immutable copy |
| LTO tape | Lowest at scale | Excellent (offline) | Slow | Large archives, enterprises |
Notice the trap: cloud sync tools are not backups. Dropbox, Google Drive, and OneDrive replicate whatever's in the folder, including encrypted junk. Most offer some version history, but recovering thousands of files from version history one at a time during a crisis is miserable. Use them for convenience, and use real, versioned, immutable backups for actual protection.
A Worked Example: 3-2-1-1-0 for a Small Business
Let's make this concrete. Say you run a small e-commerce operation. You have 500 GB of data: product photos, order records, a WordPress site database, and accounting files. Here's exactly how you'd build a survivable strategy.
The three copies:
- Copy 1 (production): Your live data on your workstation and web server. This is the copy you use daily.
- Copy 2 (local, fast restore): A nightly automated backup to a 2 TB external drive that stays connected only during the backup window, then locks. Restores from here take minutes.
- Copy 3 (offsite, immutable): A daily encrypted upload to cloud object storage with a 30-day object lock. This is your ransomware fallback.
The media types: external HDD (spinning disk) and cloud object storage. Two genuinely different technologies. ✔
The offsite copy: the cloud bucket, physically in a different region. ✔
The immutable copy: object lock on the cloud bucket means even your own admin key can't delete files for 30 days. ✔
Zero errors: on the first of every month you spin up a scratch environment and restore last night's backup into it, then confirm the WordPress site loads and the database queries return the right row counts. ✔
Now run the disaster scenario. Ransomware hits your workstation Tuesday night and encrypts everything it can reach, including files it syncs. Copy 1 is gone. Your external drive was locked and disconnected at the time, so Copy 2 survives if it wasn't in the backup window. Even in the worst case where both local copies are hit, Copy 3 in immutable cloud storage is untouchable. You wipe the infected machines, restore from the immutable copy, and you're back with at most one day of data loss. No ransom paid.
Step-by-Step: Building Your Backup System
Here's the build plan. You can do this over a weekend.
- Inventory what matters. List every data source you can't afford to lose: documents, databases, config files, website content, photos. Assign each a priority. You'll back up everything, but knowing what's critical shapes your restore order.
- Pick your two media. For most people: one local external drive plus one immutable cloud bucket. Buy a drive at least 2x your data size so you have room for multiple versions.
- Choose backup software that does versioning. You want incremental, versioned backups — not a plain copy. Tools like Restic, Duplicati, Veeam, or Borg keep multiple point-in-time snapshots so you can roll back to before the infection. For creating consistent local restore points and managing junction points on Windows, utilities like Windows Symlink Creator Pro can help you stage folders cleanly before a backup run.
- Enable immutability on your cloud copy. If you use S3-compatible storage, turn on Object Lock in Compliance mode with a 30-day retention. In Backblaze B2, enable Object Lock on the bucket. This is the step most people skip and the one that saves you.
- Encrypt before upload. Your backup tool should encrypt client-side so your cloud provider never sees plaintext. Store the encryption passphrase somewhere separate and durable.
- Automate the sch
Cover image: Corporate M&A Buyers by jurvetson, licensed under BY 2.0 via Openverse.
