Data backup: the 3-2-1 rule and what happens when it fails

Backups get thought about twice: when they are set up and when they are needed. Years usually pass between those two moments, and in them the server changes, the software changes, the amount of data changes and so does the person who set it all up. A backup that worked three years ago does not have to work today.

What the 3-2-1 rule is

• 3 copies of the data: the original and two more.
• 2 different media or systems: so that a failure of one kind of device does not destroy everything.
• 1 copy at another location: so that a fire, flood or theft at the office does not take both the data and the copies.

The rule is old, simple and still valid. Today two things are usually added to it: one copy that cannot be changed or deleted, and regular checks that data can really be restored from the copies.

What is not a backup

Synchronisation. Services that keep a folder identical on several devices also carry over deletion and damage. A file encrypted by malware is encrypted everywhere within minutes.

RAID. Two mirrored disks protect against the failure of one disk. They do not protect against deletion, a software error or an attack, because all of those are written to both at the same moment.

An external disk that is always connected. Whatever can reach the computer can reach it too.

A copy on the same server. It protects against accidentally deleting one file, but not against failure or loss of the server.

Each of these is useful. None of them is a backup by itself.

Two questions that determine everything else

Before choosing equipment and a service, two business questions need answers.

How much data can we afford to lose? If the backup runs once a day at midnight and the failure happens at four in the afternoon, a whole working day is lost. Whether that is acceptable depends on what was done that day. For a document archive it is. For a warehouse issuing three hundred delivery notes a day it is not.

How long can we afford to be down? Restoring a few hundred gigabytes from a remote location can take hours or days. If production or sales cannot work without the system, the cost of downtime should be compared with the cost of a faster solution.

The answers differ for different data. Accounting and the business system need different treatment from a folder of old presentations.

The most common reasons a backup fails

Nobody has ever tried to restore. The backup runs for years, the report says “successful” every day, and the first restore attempt shows that the file is damaged, the decryption key is missing or nobody knows the procedure.

The wrong thing is being backed up. The documents folder was set up for backup, while the database of the business software is somewhere else. Or the database was moved after an upgrade and the backup was not.

The backup is reachable with the same credentials. An attacker who gains administrator access to the network looks for backups first and deletes them, and only then encrypts the data. A backup reached with the same password as the server falls with it.

Retention is too short. The last seven days are kept. Damage or an infection is noticed after three weeks, when all the saved copies are already damaged.

Notifications nobody reads. The backup stopped working in March because the disk is full. Error messages go to the address of a colleague who has left the company.

Cloud data that someone is assumed to be keeping. The provider of an e-mail or office suite service is responsible for running the service. For your data, including what you deleted yourself, you are generally responsible.

Knowledge in one head. One person knows the restore procedure and it is written down nowhere, or it is written down on the server that needs restoring.

What a good setup looks like

• Automatic, with no step that depends on someone remembering.
• Several versions over time: daily for the last few weeks, weekly for a few months, monthly for a year or longer.
• One copy off-site, encrypted.
• One copy that cannot be changed, or is physically separated from the network.
• Separate credentials. Access to backups is not the same as access to servers, with multi-factor sign-in.
• Monitoring. A failure notice reaches a person who will act on it, and a missing report is also treated as an error.
• A test restore at least every three months, with the time measured.
• A written procedure, available even when the network is down.
• A list of what is kept: servers, databases, e-mail, cloud data, network equipment settings and, where needed, laptops.

A quick check

If you do not know the answer to one of these questions, that is the place to start:

1. When was something last actually restored from a backup?
2. How long would it take to restore the whole business system?
3. Where is the copy that would survive a fire at the office?
4. Could someone with the administrator password delete all the backups?
5. Who gets the notification when the backup fails?

The link with regulation

Backups and recovery after an incident are among the measures required by the Croatian Cybersecurity Act. We write about who is in scope in the article on NIS2. Companies that are not in scope are also increasingly getting the same question from customers and insurers.

We set up storage and backup systems as part of our cloud infrastructure and backup service, with redundant copies and a tested restore procedure. If you are not sure what would happen if you lost your server tomorrow, get in touch.