Ransomware posture and the 3-2-1 rule

Why this matters in production

Ransomware is the most common cause of “we have backups but we can’t recover.” The attackers target the backups too. PBS has features specifically designed for this threat.

The 3-2-1 rule

Three copies, on two different media, with one off-site.

Modern variants add:

• 3-2-1-1-0: 3 copies, 2 media, 1 off-site, 1 immutable/offline, 0 errors on verification.

flowchart LR
  P[Production VM] --> L[Local PBS]
  P --> O[Off-site PBS]
  L --> O
  L --> T[Tape]
  O --> S[S3 immutable]

How ransomware defeats backups

Common attack patterns:

1. Encrypt production VMs first. Then reach the backups via the same network.
2. Compromise backup credentials. Steal the PBS user’s API token; encrypt everything reachable from that account.
3. Wait. Sophisticated attackers wait weeks, gathering credentials, then strike.
4. Encrypt the backup target. Even if read-only, ransomware that runs on the PBS itself can encrypt chunks.

PBS defences

Restrictive ACLs

Use PBS’s access controls to limit who can read, write, or prune backups:

GUI: Administration → Access Control → Users. Configure roles per user.

Detection

PBS can detect ransomware patterns in backups (some recent versions):

• Sudden changes in dedup ratio (encryption makes data appear random).
• Sudden changes in backup sizes.
• Backup failures correlated with ransomware indicators.

Set up alerts for these.

Recovery posture

If ransomware hits:

1. Do not pay.
2. Isolate affected systems.
3. Restore from off-site / air-gapped backups.
4. Re-image from known-good backups, not from the infected network.
5. Investigate the entry point before reconnecting to any network.

Production considerations

Common mistakes

• Backups in the same network and credential domain as production.
• No off-site / air-gapped copy.
• PBS admin accounts without MFA.
• No restore drill from off-site copies.

Key takeaways

• 3-2-1 (or 3-2-1-1-0) is the minimum.
• Air-gap is the strongest defence.
• Rehearse ransomware recovery.

Knowledge check