3-2-1 and modern backup strategies

The 3-2-1 backup rule is the standard for backup strategy. Modern variations address ransomware and supply-chain attacks. This lesson covers both.

3-2-1 rule

• 3 copies of data (production + 2 backups).
• 2 different storage media (e.g. disk and tape).
• 1 offsite copy (in a different physical location).

This protects against:

• Disk failure (one of the copies survives).
• Media corruption (different media).
• Site loss (offsite copy).

3-2-1-1-0 rule (modern)

For ransomware protection:

• 3 copies.
• 2 different media.
• 1 offsite copy.
• 1 immutable copy (cannot be modified or deleted, even by admin).
• 0 errors (tested and verified restores).

Immutable backups cannot be modified. Even if ransomware encrypts the production system, the immutable copy is safe.

Immutable online copies

Immutable means the copy cannot be deleted or overwritten for a retention period. It is still online, and that is the point: you restore from it quickly.

S3 Object Lock:

aws s3api put-object --bucket my-backup \
    --key backup-2026-08-09.tar \
    --body backup.tar \
    --object-lock-mode COMPLIANCE \
    --object-lock-retain-until-date 2026-09-09T00:00:00Z

The object cannot be deleted or modified until the retention date. Use COMPLIANCE, not GOVERNANCE: GOVERNANCE is bypassable by any principal holding s3:BypassGovernanceRetention, which is exactly what a compromised administrative role holds. GCS Bucket Lock and Azure Blob immutable storage give the same property.

BorgBackup with append-only mode:

# On the BACKUP SERVER, in ~backup/.ssh/authorized_keys.
# One line - wrapped here for readability.
command="borg serve --append-only --restrict-to-path /backup/repo",\
restrict ssh-ed25519 AAAA...client-key... backup-client

The client can add archives but cannot prune or delete them, because the server refuses the operation.

Air-gapped copies

An air-gapped copy is offline and unreachable from the network. Options:

• Tape: rotate tapes, eject them, store one offsite.
• Disk rotation: rotate external disks, unplug them, store one offsite.

The principle: a network attacker cannot reach the air-gapped copy.

Test restore

Every backup strategy needs regular test restore:

• Quarterly: full restore drill on a non-production host.
• Annually: full DR drill including all infrastructure.

Test restore catches:

• Backup is corrupted.
• Backup is incomplete.
• Restore procedure is wrong.
• Dependencies are missing.

Cost vs duration

Different storage tiers for different retention:

Total: balance cost against recovery time and retention.

Knowledge check