Backups are the answer to almost everything
Ransomware, stolen laptops, dead hard drives, spilled coffee, an accidental "delete": completely different disasters, one identical remedy. A good backup turns each of them from a catastrophe into an inconvenience. It's the single highest-leverage protection on this entire site.
The 3-2-1 rule
Keep 3 copies of your data, on 2 different types of storage, with 1 copy off-site. Example: the original on your computer, an automatic backup to an external drive, and a cloud backup. Any single disaster, such as fire, theft, or ransomware, can't reach all three.
- Off-site matters because a burglar or a fire takes the external drive along with the computer.
- Ransomware-proofing: at least one copy should be disconnected or "versioned" (able to roll back to yesterday). Ransomware happily encrypts any backup drive that's plugged in, and syncing services will faithfully sync the encrypted files right over your good copies. Sync is not backup.
The copy an attacker can't touch: immutable off-site backup
Modern ransomware crews learned that encrypting your live files isn't enough, because a good backup defeats them. So now, once they're inside, they hunt down your backups first and delete or encrypt those too, then spring the ransom. Any backup they can reach, they will ruin. The defense is a copy that nobody can alter or erase for a set period of time, not even an administrator, and not even the attacker holding stolen admin credentials.
Immutable means write-once, read-many. Once a backup is written, it is locked against any change or deletion until a retention clock you set expires. For that window, ransomware, a rogue insider, a compromised admin account, or an honest mistake simply cannot overwrite it. When the clock runs out, the data expires and the storage is reclaimed on its own.
- Keep it off-site. Immutability and off-site go together: the locked copy lives in the cloud or a remote location, away from the network the attacker has compromised, so they can neither reach it nor delete the whole account. This is the "1" of the 3-2-1 rule, hardened into a copy that survives even a full breach.
- Set a retention window that fits your risk. Attackers often lurk for weeks before triggering ransomware, so a locked copy that only goes back a few days can already be poisoned by the time you notice. Retaining immutable copies for 30, 60, or 90 days (longer for records you're required to keep) means you can always roll back to a clean point from before the intrusion.
- Time-based expiration is a feature, not a risk. Because the data auto-expires when its retention clock ends, storage doesn't grow forever and old copies clean themselves up, while the recent, clean copies you actually need stay locked and recoverable.
- Look for the real thing. Genuine immutability is enforced by the storage itself: object-lock or WORM cloud storage (for example S3 Object Lock in compliance mode), or a reputable backup service that advertises immutable, air-gapped, or "ransomware-proof" retention. A backup you can quietly delete from the same console that runs it is not immutable.
Why this matters more every year: ransomware groups now assume you have backups and target them deliberately, and many also steal your data to extort you twice. Immutability directly defeats the first move. If you can restore from a locked copy the attacker couldn't touch, their leverage collapses, and you're recovering instead of negotiating.
Make it automatic or it doesn't exist
Backups that depend on a human remembering are backups that quietly stopped months ago. Set them up once, then let the machine do it:
- Windows: File History to an external drive, plus a cloud backup service.
- Mac: Time Machine, plus a cloud backup service.
- Phones: turn on iCloud or Google backup, photos included.
- Businesses: back up servers and cloud data too. Microsoft 365 and Google Workspace protect their infrastructure, not your deleted mailbox, where retention is limited. Dedicated backup handles that.
The step everyone skips: test the restore
The worst possible time to learn your backup wasn't working is while you're staring at a ransom note. Twice a year, pick a random file and actually restore it. Businesses should time a full recovery once a year. Knowing it takes four hours changes decisions you'd otherwise get wrong under pressure.
Do this today
- Name the data that would genuinely hurt to lose: photos, documents, financials, customer records.
- Turn on one automatic local backup and one automatic cloud backup for it.
- Make sure at least one off-site copy is immutable, with a retention window of at least 30 days that nothing can overwrite or delete early.
- Put a reminder in your calendar for six months from now: "restore one file from backup."
- Check the backup status light isn't silently red right now. (Go look. We'll wait.)