Immutable backup and the 3-2-1-1 rule: why one backup is no longer enough against ransomware

An immutable backup is a copy of your data that nobody can change or delete for a set period, not even with administrator credentials. Today it is the decisive defence against ransomware, because the more organised attacks search for and destroy backups before encrypting data. That is why the old 3-2-1 rule has evolved into 3-2-1-1, which always includes at least one immutable or disconnected copy.

For years the question was whether you had a backup. The right question now is whether your backup would survive an attack. Here is why one backup is no longer enough, how to build effective protection and how to make sure it actually works.

Why is one backup no longer enough?

One backup is not enough because, in most set-ups, it can be reached from the same network and with the same credentials as the systems it is meant to protect. Ransomware operators know this: a company with no way to restore is a company willing to negotiate. So before they strike, attackers often spend days or weeks exploring the network, locating backup copies and finding a way to remove them.

The most vulnerable set-ups

• The always-connected NAS. It is convenient, fast and automatic. But if it appears on the network as a shared folder, ransomware treats it like any other folder.
• Shared credentials. If the account that runs the backup software is the same as the domain administrator, whoever obtains it can delete copies and switch off schedules without any special tools.
• Sync mistaken for backup. Services such as OneDrive or Dropbox replicate changes: if files are encrypted on a computer, the encrypted version is synced.
• The backup nobody has tested. Jobs that report as complete but turn out to be partial, corrupted or painfully slow to restore when they are needed.

What is the 3-2-1-1 backup rule?

The 3-2-1-1 rule is a way of organising copies so that no single event can destroy all of them. It builds on the classic 3-2-1 rule, which still holds, and adds an element designed with ransomware in mind.

1. 3 copies of your data: the original plus two backups.
2. 2 different media: for example an on-site device and cloud storage, so a single technology failure cannot hit both.
3. 1 copy off site: safe from fire, flooding and theft in the building.
4. 1 immutable or offline copy: impossible to alter or physically disconnected, and therefore out of an attacker's reach.

A 0 is often added as well: zero errors in restore checks. It is a reminder that a copy nobody has verified is little more than a hope.

How does an immutable backup work?

An immutable backup works because the system storing it prevents any change until the retention period expires, by design rather than through a setting someone could switch off. The term is used a lot, sometimes generously, so it helps to know what the genuine options are.

The most common solutions

• Object storage with retention lock, in the cloud or on premises: each copy stays locked for the number of days you set, and no deletion request is carried out before then.
• Hardened repositories: backup servers configured so that written data cannot be altered and administrative access is kept to a minimum.
• Offline copies on media that are physically disconnected: less convenient to manage, but out of reach by definition.

The surroundings matter as much as the technology

Even the best immutable copy needs a few rules around it: dedicated credentials for the backup system, separate from the company domain; multi-factor authentication on the management console; alerts whenever someone tries to change retention policies; and a retention period long enough to cover the time an attack can stay hidden before it shows itself.

How long to keep copies

The retention period deserves careful thought. Too short, and a clean copy may already be gone by the time the attack is discovered; too long, and storage keeps growing without real benefit. It usually makes sense to combine recent, frequent copies, useful for everyday mistakes, with less frequent copies kept for longer, which let you go back weeks if needed. Legal requirements on keeping business records and GDPR principles, which say personal data should not be kept longer than necessary, also need to be factored in.

How often should a backup be tested?

A backup should be tested regularly and whenever something significant changes in your systems, because a backup is judged only by its restore. No single frequency suits everyone: it depends on how critical the data is and how often the infrastructure changes. A good approach combines quick, frequent tests, such as recovering a file or a mailbox, with broader periodic tests, such as restoring an entire server in a separate environment.

Two figures to agree first

Before choosing any technology, settle two targets that only the business can set:

• how much data you can afford to lose (the RPO, in technical terms): the last day's work, the last hour, nothing at all. This drives how often copies are taken;
• how long you can afford to be down (the RTO): a few hours, a day, longer. This drives how and where you restore.

With these targets agreed, tests stop being a box-ticking exercise and become a real check: you measure how long recovery actually takes and compare it with what the business can tolerate. Infrastructure monitoring that checks backup results every day completes the picture, flagging a failed job straight away rather than on the day you need it.

What should a business backup include?

A business backup should include all the data your work depends on, wherever it lives, not just the servers in your building. This is where the most common gaps are found.

• Servers and virtual machines, with business applications, databases and shared files.
• Cloud email and documents: mailboxes, OneDrive, SharePoint, Teams. A cloud service being available is not the same as being able to recover what was deleted or encrypted.
• Cloud applications, checking what the provider offers and whether data can be exported.
• Laptops belonging to people who work away from the office and save files locally.
• Configurations of firewalls, switches and phone systems: rebuilding them from memory after a failure takes hours.

How do you build an effective backup strategy?

An effective backup strategy starts from the real priorities of the business, not from a product. In practice that means identifying critical data, setting recovery targets, choosing where and how to keep copies, documenting the procedure and testing it. Backup is only one part of the defence: protection such as EDR on computers and servers aims to stop an attack before it reaches your data, while backup lets you recover if something gets through.

A well-designed system need not be complicated. But rebuilding it in a hurry after an incident costs far more, in time and peace of mind, than setting it up properly from the start. That is the principle behind our backup and disaster recovery services: tailored, tested and looked after over time.

Ransomware protection, from prevention to incident response, is also the day-to-day work of Cybernix, VAY's cybersecurity division.

If you would like to know how robust your company's backup really is, get in touch: we can review it together and check whether it would hold up under attack.

Frequently asked questions

What is an immutable backup?

It is a copy of data that, once written, cannot be changed or deleted until the end of a set retention period. The lock is enforced by the storage system and cannot be lifted even with administrator credentials, which is why it withstands ransomware.

What is the difference between the 3-2-1 and 3-2-1-1 rules?

The 3-2-1 rule means three copies of your data on two different media, with one copy off site. The 3-2-1-1 rule adds at least one immutable or offline copy, designed specifically to survive attacks that target backups.

Are OneDrive or Dropbox a backup?

No, they are synchronisation services: they replicate changes, including deletions and files encrypted by ransomware. Version history helps, but it has time limits and does not replace an independent copy.

How often should backup restores be tested?

There is no single frequency that suits everyone, but restores should be tested regularly and after every significant change to your systems. A good approach combines frequent tests on individual files or mailboxes with periodic larger tests, such as restoring a whole server.

Is an office NAS enough as a backup?

A NAS can be one of your copies, but it is not enough on its own: if it is always reachable from the company network, ransomware can encrypt it or delete its data. It needs to be paired with at least one off-site copy and one immutable or offline copy.