Backup Strategies: 3-2-1 Rule and Immutable Backups

Backups are not just an IT operational concern — they are a critical security control that directly enables recovery from ransomware, accidental deletion, hardware failure, and insider sabotage. Without tested, reliable backups, ransomware operators hold all the power: pay or lose your data. With robust, protected backups, organizations can recover without paying ransom. The Security+ exam explicitly includes backup strategy as part of business continuity and data protection requirements.

The 3-2-1 backup rule is the industry-standard baseline for backup resilience. 3 copies of data must exist (original + 2 backups). 2 different storage media types must be used (e.g., local disk and tape, or local NAS and cloud). 1 copy must be stored offsite or in a geographically separate location. This configuration ensures that no single failure — disk failure, site disaster, theft — eliminates all copies of the data. The 3-2-1 rule has been the backup gold standard for two decades.

Ransomware has exposed weaknesses in classic 3-2-1: if all three copies are network-accessible, ransomware encrypts them all. The enhanced 3-2-1-1-0 rule adds: one copy must be offline or air-gapped (disconnected from the network, physically isolated), and zero backup errors (all backups must be tested with zero failures in restore tests). The offline copy ensures that ransomware — even with domain admin access — cannot reach and encrypt all backup copies.

Immutable backups are stored in a way that makes them impossible to modify or delete for a specified retention period — even by administrators with full access. Cloud providers implement immutability through object lock (WORM — Write Once, Read Many) policies. AWS S3 Object Lock, Azure Blob immutable storage, and similar features prevent any API call from deleting or overwriting objects before the lock period expires. Ransomware groups that gain domain admin access cannot delete immutable backups, even with the highest level of cloud credentials.

Three backup types balance completeness against storage cost and backup window time. A full backup copies all data every time — provides the fastest restore but consumes the most storage. An incremental backup copies only data changed since the last backup of any type — fastest to create, smallest storage, but restore requires the last full plus all incrementals. A differential backup copies all data changed since the last full backup — medium storage growth, restore requires only the last full plus the latest differential.

Backup files must be encrypted — backup tapes sent to offsite storage or cloud backups are a target for attackers seeking sensitive data. Use AES-256 encryption for backup data at rest. Critically, backup encryption keys must be stored separately from the backups themselves: encrypting backups with a key that is also backed up in the same location defeats the purpose. Store encryption keys in a Hardware Security Module (HSM) or key management service that is independent from the backup system.

Backup systems must be isolated from the production network. If backup servers are domain-joined with the same Active Directory as production servers, ransomware with domain admin credentials can reach and encrypt backup storage. Best practices: backup servers on a separate network segment with no access from production servers, use dedicated backup credentials that are not domain admin accounts, implement backup server MFA for administrative access, and consider a separate backup domain that has no trust relationship with the production domain.

Cloud backup services provide offsite storage with immutability options and simplify the 3-2-1 rule implementation. AWS Backup, Azure Backup, and Google Cloud Backup and DR integrate with cloud services and provide centralized policy management. Third-party services like Veeam, Rubrik, and Cohesity offer cloud-native backup with immutable repositories, air-gapped vault copies, and ransomware detection that analyzes backup data for encryption entropy anomalies — alerting before a full ransomware event completes.

Many organizations discover during a ransomware incident that their backups are corrupted or unrestorable — a catastrophic discovery at the worst possible moment. Backup testing must be a scheduled, regular activity. Testing approaches include: automated restore verification (restore a sample of files daily and verify checksums), periodic full restores to isolated test environment (quarterly database restore and application startup test), and DR drills where the team follows the DRP from backup to running production on alternate infrastructure. Document every test result.

The Grandfather-Father-Son (GFS) retention scheme organizes backup retention across different time horizons. Son backups are daily (kept for 1 week, then overwritten). Father backups are weekly full backups (kept for 1 month). Grandfather backups are monthly full backups (kept for 1 year or longer). GFS provides the ability to restore from yesterday, last week, or last month — balancing recovery flexibility against storage cost. Many compliance frameworks require GFS-style retention for audit trail purposes.

Backup failures are silent disasters — a backup job that silently fails for weeks means no protection exists when it is needed most. Backup monitoring must track: whether each scheduled backup job completed successfully, whether the backup size is within expected range (a suspiciously small backup may indicate a partial failure), whether backup encryption key access was successful, and whether the backup transferred to all required destinations (local + offsite). Alerts should fire immediately on any failed job, with escalation if failures persist beyond a single attempt. Treat a failed backup as a Priority 2 incident.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: the 3-2-1 rule requires 3 copies on 2 media types with 1 offsite, the enhanced 3-2-1-1-0 rule adds an offline/immutable copy and requires zero restore failures, and immutable/WORM storage prevents ransomware from destroying backups even with full administrative credentials. Next up we explore failover testing through tabletop exercises and DR drills to validate that recovery plans work in practice.