The 3-2-1 backup rule, and why modern threats added a 1 and a 0

The 3-2-1 rule is the most widely quoted principle in data protection, because it is simple and it works.

The original rule

• 3 copies of your data: the live copy and two backups.
• 2 different kinds of storage, so one type of failure cannot destroy everything.
• 1 copy off-site, so a fire, flood or theft at one location is survivable.

The modern extension: 3-2-1-1-0

• 1 copy that is offline or immutable. Ransomware groups hunt for backups and delete or encrypt them. A copy that cannot be changed, because it is disconnected or locked by policy until its retention ends, survives an attacker with administrator rights.
• 0 errors. A backup is only proven when it restores. Verify backups automatically and run real restore tests, so "zero errors" is a measured fact rather than a hope.

Putting it into practice

1. Decide what must be protected: databases, file shares, mail, configuration, code repositories, and the settings needed to rebuild servers.
2. Choose how often. Data that changes all day needs frequent backups; static archives need fewer.
3. Choose how long to keep each version. Keep enough history to go back before a problem was noticed, which for ransomware can be weeks.
4. Send at least one copy to a different provider or region, with separate credentials.
5. Turn on immutability where the storage supports it.
6. Schedule restore tests and record the results.

Common mistakes

• Treating RAID, replication or sync as backup. They copy mistakes and deletions instantly.
• Backing up to a disk in the same server or the same building.
• Using the same administrator account for production and backups.
• Never testing a full restore until the day it is needed.

How IDX helps

IDX Box Storage provides separate backup space reachable over FTP, SFTP, SMB or WebDAV, with sub-accounts and snapshots. Our Object Storage offers S3-compatible buckets for backup tools that support them. For a managed approach, our Data Backup service keeps encrypted, versioned backups in a separate region.