Backup

The Only Rule That Matters

• Untested backups are not backups — schedule regular restore tests, not just backup jobs
• Test restores to different hardware/location — validates both backup and restore procedure
• Time the restore — know how long recovery actually takes before disaster strikes

3-2-1 Rule Violations

• Same disk as source data = not a backup — disk failure loses both
• Same server as source = not a backup — ransomware/fire/theft takes both
• Same cloud account = risky — account compromise or provider issue loses both
• Cloud sync (Dropbox, Drive) is not backup — syncs deletions and corruption too

Ransomware Protection

• Backups accessible from production get encrypted too — air gap or immutable storage required
• Append-only/immutable storage prevents deletion — S3 Object Lock, Backblaze B2 with retention
• Offline rotation (USB drives, tapes) for critical data — can't encrypt what's not connected
• Test restoring from immutable backup — verify ransomware can't corrupt the restore process