A backup only helps after a ransomware attack if the attack could not reach it. This guide shows a small business how to set up the “3-2-1” arrangement described by the UK’s National Cyber Security Centre (NCSC), with a local copy, a cloud copy and an offline copy, and how versioning and locked storage help backups survive.

Why connected backups are not enough

In a blog post on offline backups, the NCSC says it has seen numerous incidents where ransomware encrypted not only the original data but also the connected USB and network storage drives holding backups, and others where connected cloud storage containing backups was compromised. The #StopRansomware Guide from the US Cybersecurity and Infrastructure Security Agency (CISA), the Multi-State Information Sharing and Analysis Center, the National Security Agency and the FBI gives the same reason for keeping backups offline: many ransomware variants try to find and delete or encrypt accessible backups.

The rule in one line

The NCSC calls 3-2-1 the most common method for resilient backups: at least three copies, on two devices, and one offsite. It adds that the rule does not require any copy to be offline, so it pairs it with an “offline rule”: at any given time, at least one backup should be disconnected, so a single incident cannot hit every copy.

Step 1: List what the business needs

The NCSC’s small organisations guide says to back up all the data the business needs to operate, which could include its website, emails, invoicing, documents, presentations, contacts and customer information. CISA also recommends keeping up-to-date “golden images,” preconfigured operating system and software templates that can rebuild a critical system quickly.

Step 2: Make a local copy and unplug it

  1. Copy the data to an external hard drive or USB stick.
  2. Disconnect it when the backup finishes. The NCSC says the device should not stay connected when not in use, because some viruses also affect devices connected to an infected computer.
  3. Keep it somewhere secure. The NCSC’s offline rule also says never to have all backups connected at the same time.

Step 3: Add a cloud copy offsite

  1. Choose a cloud service if you have reliable internet access, and protect the account with 2-step verification, as the NCSC advises.
  2. Limit which devices hold credentials to the backup. The NCSC says backup clients should not have valid credentials while the storage is not in use, should be kept to a minimum, and standard user devices should not be able to modify cloud backups directly.
  3. If the service supports it, allow authorized clients only to create new backups or append to existing ones, and deny connections while the storage is not in use.

Step 4: Turn on versioning and locking

The NCSC’s “recovery rule” says to check that a provider can restore modified data to an older version and recover deleted data for a limited time. CISA recommends enabling delete protection or object lock on storage often targeted by ransomware and considering version control to keep multiple variants of files.

Two vendor examples show how this works. Microsoft’s Restore your OneDrive feature lets Microsoft 365 subscribers undo all actions on files and folders from the last 30 days if they were deleted, overwritten, corrupted or infected by malware. Sign in at onedrive.com and choose Settings, then Options, then Restore your OneDrive (for work or school accounts, Settings, then Restore OneDrive), pick a date, review the activity and choose Restore.

For businesses using Amazon Web Services, S3 Object Lock stores objects in a write-once-read-many model so they cannot be deleted or overwritten for a set period or indefinitely. It works only in buckets with S3 Versioning enabled. In governance mode, users with special permissions can still change settings or delete; in compliance mode, no user, including the account’s root user, can delete a locked version until its retention period ends.

Step 5: Back up often and test restores

The NCSC says the more often backups are made, the less data is lost in a recovery, and that backups should be tested regularly. Its small organisations guide adds that you should know how to restore and check that the backup contains all your important data. CISA recommends testing the availability and integrity of backups in a disaster recovery scenario.

Common problems

  • The backup drive is always plugged in. Then it is not offline. The NCSC says to connect backups to live systems only when absolutely necessary.
  • Files were permanently deleted from OneDrive. Microsoft says a file permanently deleted from the OneDrive recycle bin can never be recovered.
  • Locked data cannot be removed. AWS says the only way to delete an object in compliance mode before its retention date is to delete the AWS account. It suggests governance mode for testing retention settings first.
  • Regulatory doubts. CISA warns that immutable storage does not meet compliance criteria for certain regulations and that misconfiguration can be costly.
  • Restoring brings the attack back. CISA says to identify any “dropper” malware before rebuilding from backups, then restore from offline, encrypted backups in order of the most critical services.

Corrections and tips: email the editor using the address on the Contact page.