3.1Backups: the defense against ransomware
The essentials in 30 seconds
- 3-2-1: 3 copies of the data, on 2 different media, including 1 offsite (cloud or external drive stored elsewhere).
- Offline = anti-ransomware: the unplugged drive is the only copy that encryption cannot reach.
- Test the restore: a backup never tested is often worth zero on D-day; at work, store files in the locations backed up by IT.
Running mini-case — Karim and the drawer drive
Karim, an office employee in Algiers, keeps his tracking spreadsheets only on his laptop. After ransomware encrypts the shared folder, he discovers the 3-2-1 rule: he enables cloud sync for his key folders, adds an external drive with a monthly backup unplugged in between, then tests restoring a file. His data now survives theft, failure, error and ransomware.
This same case returns in the lesson, the diagram, the script and the 48h challenge.
1. What saves you when ransomware strikes
When ransomware strikes, the only thing that separates those who recover in a few days from those who lose everything is the quality of backups. Without a healthy copy, the only options left are paying (with no guarantee) or rebuilding everything.
The rule: 3 copies on 2 different media, including 1 offsite (cloud or external drive stored elsewhere). At work, business files belong in the locations backed up by IT (servers, corporate cloud), never only locally.
2. Offline and tested restore
The offline copy (drive unplugged between backups) is the only one ransomware cannot encrypt: cloud sync alone is not enough, because mass encryption syncs too. Versioning (version history) limits this risk; the offline copy eliminates it.
Critical point: periodically test the restore — recover a previous version of a file and a file from the external drive. Frequency follows acceptable loss: one working day you cannot afford to lose = daily backup (the cloud does it continuously); for the personal offline copy, a monthly rhythm is a good floor.
🔎 Concrete example — Your personal 3-2-1
Karim protects his folders in three steps.
Copy 2: cloud sync of key folders.
Copy 3: monthly external drive, UNPLUGGED in between (anti-ransomware).
Test: restore one file (version history) + one from the drive.Reading: each copy covers one scenario (theft, failure, error, ransomware).
Lesson: the offline copy is the only one encryption cannot reach.
Section vocabulary
- 3-2-1 rule
- 3 copies of the data, on 2 different media, including 1 offsite: the backup standard.
Simple example: Karim: laptop + cloud + monthly external drive.
What it is not: simple cloud sync with no other copy.
Reflex: count your copies: 3, on 2 media, 1 offsite.
- Offline backup
- Disconnected copy (unplugged drive): the only one ransomware cannot encrypt.
Simple example: Karim's external drive, stored unplugged in between.
What it is not: a folder synced continuously.
Reflex: unplug the drive after each backup.
- Versioning
- Version history of a file allowing rollback to the state before the incident or error.
Simple example: Recovering the pre-encryption version via history.
What it is not: the recycle bin alone with no history.
Reflex: right-click → version history to test.
- Restore test
- Periodic check that a backup really restores: half of the discipline.
Simple example: Karim restores one file from the cloud and one from the drive.
What it is not: seeing that the backup “ran” without restoring anything.
Reflex: test a restore with each monthly backup.
- RPO (acceptable loss)
- How many hours or days of work you accept losing: it dictates backup frequency.
Simple example: One acceptable day = daily backup at minimum.
What it is not: backing up “when you think of it”.
Reflex: choose your frequency from the acceptable loss.
In practice — Set up your personal 3-2-1
- Identify your irreplaceable files (work: normally already on corporate servers/cloud — check! personal: photos, documents).
- Copy 2: enable cloud sync (OneDrive/equivalent) for these folders.
- Copy 3: an external drive, monthly backup (calendar reminder), unplugged in between — this is your anti-ransomware copy.
- Test the restore: recover a previous version of a OneDrive file (right-click → Version history) and a file from the external drive.
Ready-to-say script — ask where to store at work (30 s)
“For my work folders, which location is backed up by IT: server or corporate cloud? I want to check that nothing important stays only locally on my laptop, and I am setting up the offline copy for the rest.”
Say to IT or the contact person; note the exact location before moving files.
Copy-paste template — 3-2-1 sheet
IRREPLACEABLE FILES: _______________
COPY 1 (workstation/server): _______________
COPY 2 (synced cloud): _______________
COPY 3 (monthly external drive, unplugged): _______________
RESTORE TEST (date + file): _______________Micro-business / freelancer
Without IT: cloud + a monthly external drive unplugged + a calendar reminder is enough to hold the 3-2-1.
SME Algeria
Store the external drive away from the office (locked cabinet, another room): offsite means away from the same disaster.
Office / employee
Ask IT for the official backed-up location and stop working locally: the level-3 professional reflex.
Beginner
Start with a single key folder (work documents): cloud + drive + one restore test this month.
✓ Best practices
- Keep an offline copy (unplugged drive) for ransomware.
- Test the restore regularly, not just the backup.
- At work, store files in the locations backed up by IT.
✗ Common pitfalls
- Confusing cloud sync with a real backup (encryption syncs too).
- Never testing the restore.
- Keeping everything only locally.
Key takeaways
- 3 copies, 2 media, 1 offsite/offline: the rule that covers every scenario.
- The OFFLINE copy is the specific defense against ransomware (which encrypts everything connected).
- A backup never tested for restore is a hypothesis, not protection.
- At work: store files in the locations backed up by IT (servers, corporate cloud), never only locally.
48h challenge — apply tomorrow
Enable cloud sync for one key folder and restore a previous version: your first restore test.
- I can recite the 3-2-1 rule without hesitation.
- I know why the offline copy stops ransomware.
- I tested 1 restore (cloud or drive).
Frequently asked questions
Is OneDrive/the corporate cloud enough as a backup?
It is an excellent layer (versioning, recycle bin, redundancy), but syncing is not a complete backup: mass encryption syncs too. Versioning limits this risk; the offline copy eliminates it.
How often should I back up?
The reverse question: what can you stand losing? One working day = daily backup (the cloud does it continuously). For the personal offline copy, a monthly rhythm is a good floor.
Which copy can ransomware NOT encrypt?