Backups &
encryption

The 3-2-1 rule — and the 3-2-1-1-0 upgrade

Backup is the only security measure that saves you regardless of what went wrong: ransomware, theft, fire, disk failure or your own mistakes. The standard advice, which the US authorities' StopRansomware initiative also builds on, is the 3-2-1 rule:

• 3 copies of your data (the original + two backups).
• 2 different storage types (e.g. external drive + cloud).
• 1 copy in another physical location (the cloud counts — fire and burglary can't reach it).

The more modern 3-2-1-1-0 variant adds: 1 copy offline or immutable (so ransomware can't reach it) and 0 errors — you've actually tested that the restore works. For a private individual that sounds ambitious, but in practice it means: cloud backup + one external drive that isn't plugged in, and a test restore once a year.

Cloud sync is not backup

"But my files are in Google Drive/OneDrive/iCloud." Sync services mirror your devices — which means they faithfully mirror the disaster too. Delete the wrong folder, and the cloud copy is deleted. If ransomware encrypts your files, the encrypted versions sync up within minutes.

What saves you in sync services is version history and the recycle bin — most services can restore previous versions for 30 days. Valuable, but limited and time-critical. Real backup is a separate, independent copy that doesn't overwrite itself when the original is destroyed.

How to do it — computer and phone

Windows

1. The cloud (location no. 2): a backup service like Backblaze (~$99/yr, unlimited) backs up the whole computer continuously, with version history — set it up once, forget it.
2. Local (fast restores): external drive + Windows' built-in backup/File History. Unplug the drive between runs — that's your offline copy.

Mac

1. Local: Time Machine to an external drive — versioned, automatic, built in. Unplug the drive between runs.
2. The cloud: Backblaze works just as well on Mac, as the off-site complement.

The phone

Enable iCloud Backup or Google backup respectively — and verify that photos are actually included (iCloud Photos/Google Photos). The phone's content then also lands in the computer's backup chain if you sync.

Encrypt the disks: BitLocker and FileVault

Backup protects against loss — encryption protects against whoever takes your device also getting your data. A stolen unencrypted laptop is an open archive: the disk can be mounted in another computer and read directly; your login password is irrelevant.

• Windows: enable BitLocker/device encryption.
• Mac: enable FileVault.
• Phones: modern iPhones and Android devices are encrypted as long as a screen lock is set (episode 8).
• External backup drives: encrypt those too — otherwise the backup becomes your weakest point.

Three ransomware-specific tips

1. Keep one copy out of reach. Ransomware encrypts everything it can touch — including connected USB drives and network folders. The unplugged drive and the cloud backup's version history are your lifelines.
2. Version history is the requirement for cloud backup. A mirror of encrypted files is worthless; the ability to retrieve files as they looked last week is everything.
3. Test the restore. Once a year: pull three random files out of the backup. A backup that's never been tested is a hope, not a plan — that's the "zero" in 3-2-1-1-0.

Sources

Want to dig deeper? These are the sources behind this episode.

1. Backblaze — The 3-2-1 Backup Strategy — the rule's background and practice.
2. CISA et al. — StopRansomware — government advice with offline backup at its core.
3. Veeam — 3-2-1-1-0 — the modern extension of the rule.
4. Microsoft — Back up your Windows PC — built-in tools.
5. Apple — Time Machine — Mac backup step by step.
6. Backblaze — backblaze.com — unlimited cloud backup for computers.
7. Microsoft — Turn on device encryption (BitLocker).
8. Apple — FileVault — disk encryption on Mac.
9. Apple — iCloud — iPhone backup.
10. Google — Back up Android — phone backup step by step.