Ransomware works by making your data unusable and demanding payment to restore it. Good backups remove much of an attacker’s leverage, but only if the backups themselves survive the attack. Modern ransomware commonly hunts for backup copies and tries to encrypt or delete them first. Designing a strategy for that reality is the difference between a bad week and a business-ending event.

Backups Are Not the Same as Sync

Start by clearing up a frequent misunderstanding. File sync services keep copies of files across devices, which is convenient but not a backup. If a file is encrypted or deleted on one device, the change often syncs everywhere. Some sync services keep version history that can help, but you should check the vendor’s current documentation and test it rather than assuming.

A real backup is a separate, point-in-time copy that remains intact even when the original is damaged, whether by ransomware, accidental deletion, hardware failure or a mistaken change.

The 3-2-1 Idea, Updated

A long-standing rule of thumb is 3-2-1: keep at least three copies of your data, on two different types of storage, with one copy offsite. It is a useful starting point. Modern guidance often adds two refinements:

• One copy that is offline, isolated or immutable. An attacker who gains administrator access to your network should not be able to alter or erase it. Options include disconnected media, storage with write-once protection, or cloud backup with separate credentials and retention locks.
• Zero unverified backups. A copy that has never been restored is an assumption, not a safeguard.

Choosing What to Protect First

You may not be able to back up everything with the same frequency or speed. Decide using two ideas:

• Recovery point objective (RPO): how much recent work you can afford to lose. If it is one day, you need at least daily backups.
• Recovery time objective (RTO): how long you can be without the system. If the answer is a few hours, you need a faster restore method than shipping a drive across town.

Rank your systems accordingly. Email, customer records and financial data typically come first, followed by shared files and then lower-priority systems.

Backup Approach Comparison

Approach	Strength	Weakness	Best used for
External drive kept connected	Cheap and fast	Encrypted along with the main system	Not recommended as the only copy
External drive rotated offline	Strong isolation	Manual effort; copies grow stale	Small offices with simple needs
Cloud backup with separate credentials	Offsite, automatic	Restore speed depends on bandwidth	Most small teams
Immutable or write-once storage	Resists deletion and tampering	Requires configuration and planning	Critical data
Provider-native snapshots only	Convenient	May share fate with the account	A supplement, not the sole copy

Protect the Backup System Itself

Attackers aim at your backups, so treat the backup system as a high-value target.

1. Separate credentials. Backup administration should use accounts not shared with everyday domain or cloud administration, protected by multi-factor authentication.
2. Limit network reach. Backup servers and storage should not be reachable from ordinary workstations.
3. Retain multiple versions. Ransomware can sit unnoticed for days. If you keep only the latest copy, you may be backing up already-encrypted files.
4. Encrypt backups, and store the decryption keys somewhere that is not itself held only on the systems being backed up.
5. Monitor backup jobs. A job that silently fails for weeks is a common cause of nasty surprises. Send alerts to a person who will notice them.

Test the Restore, Then Document It

Schedule restore tests at least a couple of times a year, and after any significant change to your systems. Pick a random file, then a whole folder, and occasionally a full system, and record how long each takes. The time is your real RTO, which is often longer than people expect.

Write a short recovery runbook: which systems come back first, where the backups are, who holds the credentials, who to call, and how to rebuild a clean environment. Keep a printed or offline copy, because if the attack takes down your network, the digital version may be unreachable.

A Realistic Example

Imagine a hypothetical nine-person architecture practice that stores project files on an office server, backed up nightly to a drive plugged into the same server. During a tabletop exercise, the owner asks what would happen if ransomware encrypted the server. The IT contractor realizes the backup drive would be encrypted too. The practice adds a cloud backup running under separate credentials with several weeks of retained versions, keeps a rotated offline drive for monthly copies, and schedules a restore test each quarter. In the first test, restoring the main project folder takes noticeably longer than expected, prompting them to prioritize the active projects for faster recovery. They also discover that one important folder sat outside the backup selection, a gap now corrected. No attack occurred, but the exercise turned an unnoticed single point of failure into a tested plan.

Backups and Privacy Obligations

Backups contain the same personal and confidential information as live systems, so they carry the same duties. Encrypt them, limit access and apply sensible retention, deleting old copies when you no longer have a reason to keep them. Rules about retention, deletion requests and breach notification vary by jurisdiction, so consult a qualified professional about what applies to you.

Frequently Asked Questions

Should we ever pay a ransom? Authorities and security professionals generally advise against it, because payment does not guarantee recovery and may encourage further attacks. Legal considerations may also apply. Seek qualified advice and involve law enforcement guidance in your region.

How often should we back up? As often as your recovery point objective demands. Daily is a common starting point, while rapidly changing systems may need more frequent copies.

Is cloud backup safe from ransomware? It is safer than a connected local drive, but only if it uses separate credentials, multi-factor authentication and ideally version retention or immutability. A cloud backup reachable with the same stolen administrator account can be deleted too.

How long should we keep backup versions? Long enough to cover the time an infection might go unnoticed, plus any legal or business requirements. Weeks to months is common, but your needs may differ.

What is the most common backup mistake? Never testing a restore. Many teams find out only during an emergency that the backup was incomplete, misconfigured or too slow.

Next Step

Pick one critical folder and perform a test restore this week, timing how long it takes. Then check whether at least one backup copy is isolated from your main network credentials.