Secure Backups: Your Last Line of Defense, Tested

Backups only count if they restore

Backups are the control that decides whether a ransomware attack is a bad week or an existential crisis. Yet we regularly meet organizations that discover, in the middle of an incident, that their backups were incomplete, encrypted along with everything else, or had silently failed months earlier. A backup you have never restored is a promise, not a guarantee.

The 3-2-1 foundation, updated for ransomware

The classic rule still holds, with a modern addition:

• Keep at least three copies of your data.
• On two different types of media.
• With one copy offsite.
• And crucially, ensure at least one copy is offline or immutable, so attackers who reach your network cannot delete or encrypt it.

Why the offline or immutable copy is non-negotiable

Modern ransomware operators deliberately hunt for and destroy backups before they trigger encryption, because they know backups are what let you refuse to pay. If your backup system is online and reachable with the same credentials as everything else, it is part of the attack surface, not your safety net. An immutable or air-gapped copy breaks that chain.

Habits that make backups trustworthy

• Test restores regularly, and time how long a full recovery actually takes.
• Confirm you are backing up the right things, including cloud services and configurations, not just file servers.
• Protect backup systems with separate credentials and strong authentication.
• Monitor for failed or missing backup jobs so gaps do not go unnoticed.
• Understand your recovery objectives: how much data you can afford to lose and how fast you must be back.

Takeaway

Good backups are your final safety net, but only if they are offline or immutable, comprehensive, and proven by regular restore tests. Build and verify that safety net now, while it is calm, not during the incident when it is too late to fix.