Overview
The final pillar of hardening is backups — the ability to recover data and systems after loss, corruption, or attack. In the age of ransomware, good backups are one of the most important security controls a system can have. This capstone lesson covers backups as a security measure.
Learning objectives
- Explain why backups are a security control, not just an IT chore.
- Describe backup principles (including the 3-2-1 rule).
- Connect backups to recovery from attacks like ransomware.
Core concept
Backups are copies of data (and sometimes whole systems) kept so you can restore after loss. As a security control they protect availability and enable recovery. Key principles:
- 3-2-1 rule — keep 3 copies of data, on 2 different media, with 1 copy off-site (or otherwise isolated).
- Isolation/immutability — at least one backup should be offline or immutable so malware (e.g. ransomware) cannot encrypt or delete it.
- Test restores — a backup is only real if you have verified you can restore from it.
- Regular schedule — backups must be current enough to limit data loss.
How it works
Backups are taken on a schedule and stored so that a failure or attack affecting the primary system does not also destroy the backups. The 3-2-1 approach ensures no single event (hardware failure, fire, ransomware) wipes out every copy, and keeping one copy offline/immutable specifically defeats ransomware that seeks out and encrypts reachable backups. Crucially, restores must be tested — untested backups frequently fail when needed. Recovery from many incidents ultimately depends on having clean, restorable backups.
Practical example
An organization hit by ransomware finds its live systems encrypted. Because it followed 3-2-1 — including an offline copy the malware could not reach — it restores systems from clean backups rather than paying a ransom. Beforehand, it had periodically tested restores, so the recovery worked as expected. The backups turned a potential catastrophe into a recoverable incident.
Cybersecurity relevance
Backups are a critical security control because they protect availability and provide the ultimate recovery path from destructive incidents — ransomware, data corruption, insider damage, or hardware failure. Attackers increasingly target backups precisely because their absence forces victims to pay, which is why isolation/immutability matters. Backups do not prevent an attack, but they determine whether an organization can recover from one — making them a cornerstone of resilience and the final piece of a hardening program.
Common mistakes
- Never testing restores, then discovering backups are unusable during a real incident.
- Keeping all backups online/reachable, so ransomware encrypts them too.
- Infrequent backups, leading to large data loss when recovery is needed.
Key takeaways
- Backups are a security control that protects availability and enables recovery from loss, corruption, and attacks.
- Follow the 3-2-1 rule (3 copies, 2 media, 1 off-site/isolated) and keep at least one copy offline/immutable to survive ransomware.
- Test restores regularly — an untested backup is not a reliable backup; backups determine whether you can recover from a destructive incident.
Check your understanding
- What does the 3-2-1 backup rule specify, and why does keeping one copy offline matter against ransomware?
- Why is testing restores essential, and what does a backup protect that prevention alone cannot?