How to Protect Backups from Ransomware

This guide explains how to structure and secure your backups so that even if ransomware hits your systems, you can restore your data without paying a ransom. You will learn the 3-2-1 backup rule, how to make backups immutable, and how to test your recovery plan. Start with what you have and improve from there.

What You’ll Need

• At least one external drive or cloud storage service (ideally two different media)
• Backup software (built-in OS tools like Windows File History or macOS Time Machine work, or a third-party tool)
• Access to your router or cloud storage settings for enabling versioning or immutability
• Basic command-line knowledge if you plan to use scripts (optional)

Step-by-Step

1. Identify what to back up. List critical files: documents, photos, databases, configuration files, and any data that would be painful to lose. Do not include system files or installed programs; you can reinstall those.
2. Follow the 3-2-1 rule. Keep at least 3 copies of your data: 1 primary (on your computer), 2 backups (on different media), and 1 of those backups offsite (e.g., cloud or a drive stored elsewhere). This ensures that even if one backup is compromised, another remains.
3. Use versioning. Enable versioning on your backup destination. Many cloud services (Google Drive, Dropbox, OneDrive) and backup tools (Veeam, Acronis) keep previous versions of files. If ransomware encrypts your files, you can roll back to a clean version from before the attack.
4. Make backups immutable. Immutable backups cannot be modified, deleted, or encrypted, even by a ransomware attacker with admin rights. Use object lock on cloud storage (e.g., AWS S3 Object Lock, Azure Blob immutability) or a backup appliance that supports immutability. For local drives, use write-once media (optical discs) or a separate user account with read-only permissions.
5. Disconnect backups after use. For local backups, physically disconnect the drive or disconnect the network share after the backup completes. A ransomware infection that spreads over the network cannot reach a disconnected drive. Schedule backups to run, then automatically unmount the drive.
6. Use separate credentials. Do not reuse your main admin password for backup accounts. Use strong, unique passwords and enable multi-factor authentication (MFA) on cloud backup accounts. This prevents an attacker who steals your password from deleting your backups.
7. Test restores regularly. At least once a month, restore a few files from your backup to a test folder. This confirms that the backup is not corrupted and that you know how to restore when needed. Also test a full system restore on a spare machine if possible.
8. Monitor backup health. Set up alerts for backup failures. If a backup fails, fix it immediately. A backup that does not run is not a backup. Many backup tools send email notifications.
9. Keep an offline copy. For the most critical data, maintain a backup that is completely offline (e.g., a hard drive stored in a safe, or a tape backup). This is your last resort if all other backups are compromised.
10. Document your recovery plan. Write down the steps to restore from each backup type, including passwords and where the backups are stored. Store this document in a secure place (password manager or printed copy). This helps you act quickly during an attack.

Common Mistakes

• Keeping backups always connected. If the backup drive is always plugged in, ransomware can encrypt it along with your main files. Disconnect it after each backup.
• Using the same password for everything. If an attacker gets your main password, they can access your backup account and delete or encrypt it. Use unique passwords and MFA.
• Skipping versioning. Without versioning, a single backup is only as good as the last snapshot. If ransomware encrypts your files, the backup may also contain encrypted versions.
• Not testing restores. Many people discover their backups are useless only when they need them. Regular testing prevents this.
• Ignoring backup errors. A backup that fails silently is a false sense of security. Check logs and set up alerts.

Tips

• Use the 3-2-1 rule as a minimum. For extra security, consider 3-2-1-1-0: one backup offline, and zero errors in your backups.
• Encrypt your backups. If you use cloud storage, enable encryption (client-side encryption is best). This protects your data if the cloud provider is breached.
• Consider a backup appliance. Some NAS devices (like Synology or QNAP) offer built-in ransomware protection with snapshot technology. These can be a good investment for small businesses.
• Use a dedicated backup user account. On Windows, create a separate user account that only has permission to write to the backup drive, not read or delete. This limits what an attacker can do if they compromise your main account.
• Keep backup software updated. Backup software often includes security patches. Outdated software can be exploited.

Troubleshooting

• Backup fails with “access denied.” Check that the backup account has write permissions to the destination. If using a network share, ensure the share is mounted and credentials are correct.
• Restore takes too long. If restoring a large amount of data is slow, consider using a local backup for speed and a cloud backup for offsite redundancy. For cloud, use a faster internet connection or a backup service that supports incremental restores.
• Versioning not available. If your backup tool does not support versioning, switch to a tool that does, or manually keep multiple copies of important files (e.g., copy to a separate folder with a date).
• Immutable backup not possible on your hardware. If your drive or cloud service does not support immutability, use the disconnect method: physically disconnect the drive after backup, or use a cloud service that offers object lock (like AWS S3 or Wasabi).
• Ransomware encrypted your backup before you disconnected. If this happens, you may still have version history if you enabled it. If not, you may need to rely on your offline copy. This is why the 3-2-1 rule is critical.

Frequently Asked Questions

Can ransomware encrypt my cloud backups?

Yes, if the backup is connected to your computer or network and the ransomware has your credentials, it can encrypt or delete cloud backups. Using versioning and immutable storage prevents this.

What is the difference between a backup and a snapshot?

A backup is a copy of your data, often stored separately. A snapshot is a point-in-time image of a system or volume, often stored on the same storage. Snapshots are useful for quick recovery but can be vulnerable if the storage is compromised.

How often should I back up?

It depends on how much data you can afford to lose. For critical business data, back up daily or even continuously. For personal files, weekly is often enough. The key is to back up as often as you are comfortable losing that amount of work.

Is an external hard drive enough to protect against ransomware?

Yes, if it is disconnected after backup and you keep multiple versions. However, it is not enough if you leave it connected, because ransomware can encrypt it. Combine it with an offsite backup for best protection.

What does “immutable” mean in backups?

Immutable means that the backup cannot be changed, deleted, or overwritten for a set period. This is enforced by the storage system (e.g., object lock) or by hardware (write-once media). Even if an attacker gains access, they cannot alter the backup.

Should I use a cloud backup service or a local drive?

Use both. Cloud backups are offsite and convenient, but they can be slow to restore large amounts of data. Local drives are fast but must be disconnected to be safe. The 3-2-1 rule recommends two different media, so a combination is ideal.

Related

• Mortal Shell 2 Parasitic Stash Dungeon Walkthrough
• RF Front End Components in 4G & 5G Devices
• How to Turn Off Autoplay on Hulu While Watching Movies