The Dangerous Illusion of "We Have Backups"
Ask any business owner if their data is backed up, and most will say yes. Ask when they last simulated a complete disaster recovery drill by restoring a database to a clean machine, and the room falls silent.
In modern cybersecurity incidents, ransomware operators actively seek out local network shares, NAS boxes, and connected backup drives. They delete snapshots and encrypt backup archives *before* triggering encryption on workstations.
If your backup repository is accessible with standard Windows domain administrator credentials, your backup will be destroyed simultaneously with your production files.
---
The 3-2-1-1-0 Backup Rule
The classic 3-2-1 strategy has evolved to meet modern ransomware threats:
- **3 Copies of Data:** One primary production copy and at least two distinct backup copies.
- **2 Different Storage Media:** For example, one copy on a local Network Attached Storage (NAS) array and another in secure cloud object storage.
- **1 Off-Site Copy:** Keep at least one copy in a physically separated data centre or geographical region to protect against fire, theft, or localized flooding.
- **1 Immutable or Air-Gapped Copy:** Ensure at least one backup repository is write-once-read-many (WORM) or completely disconnected from the network when not actively running.
- **0 Errors on Recovery Testing:** Verify backup integrity through scheduled automated recovery drills.
---
Practical Implementation for Indian SMBs
Tier 1: Local NAS with Btrfs / ZFS Snapshots Deploy a 4-bay business NAS configured with RAID 5 or RAID 10. * Configure immutable snapshots on the file system level taken every 2 hours and retained for 30 days. * Snapshots taken at the file system level cannot be deleted or encrypted by ransomware running inside user sessions on connected laptops. * Use dedicated backup service credentials that are completely separate from everyday user accounts.
Tier 2: Encrypted Off-Site Cloud Storage Replicate your local backup jobs to secure cloud storage every night. * Cost-effective options include AWS S3 Glacier Flexible Retrieval, Wasabi, or Backblaze B2. * Enable **Object Lock (Compliance Mode)** on your cloud bucket for 30 days. Even if an attacker steals your master cloud administrative credentials, Amazon or Wasabi's compliance mode mathematically prohibits deletion or modification of locked objects until the retention period expires.
---
Conducting a Quarterly Restore Drill
A backup that cannot be restored is merely an expensive hallucination. Every 90 days, schedule a 2-hour recovery drill: 1. Select 3 random critical files from 30 days ago. 2. Restore them to an isolated sandbox laptop. 3. Verify file hashes and open the files to confirm no corruption. 4. Document the time taken to restore and file the log in your IT operations register.
This simple habit ensures that when a hard drive fails or a ransomware outbreak strikes, recovery is an orderly engineering task rather than an existential business crisis.