Every office has a backup. Very few have one they've tested, and almost none have one that would survive the way a modern attack actually works. The rule that fixes this is old, short, and still right: three, two, one.
Three copies
The live files, a backup, and a backup of the backup. Two copies feels like enough until the drive holding the backup is the one that dies, or the backup software quietly stopped working in March and nobody noticed until September.
Two kinds of storage
Not three folders on the same disk. The live data on the server's drives, a backup on different drives or a different machine, and a copy that isn't spinning in the same room. A mirrored drive is not a backup: it faithfully mirrors the ransomware too.
One off site, and this is the one that matters
A copy outside the building, and, this is the part that changed in the last few years, one that can't be altered or deleted from the office. Ransomware groups now look for the backups first and encrypt or wipe them before they touch the live files, so a backup the server can write to is a backup the attacker can destroy.
The fix is an off-site copy with a lock on it: each night's copy is kept for a set number of days and nothing, not even an administrator's password, can shorten that. If the worst happens, last night's copy is sitting there untouched.
The step everyone skips
A backup nobody has restored is a guess. Pick a file, a folder, and once a quarter a whole machine, and actually bring it back. Time it. Write down that it worked. If it didn't, you just learned that on a Tuesday instead of during a crisis. On our managed plans that restore happens every month and you get the result in writing, because otherwise it doesn't happen.
What good looks like for a small office
- Nightly backup of the server to a second set of drives, with versions kept for 30 days.
- Nightly copy off site, encrypted before it leaves, locked for 30 days.
- Backups of the computers that hold work, not just the server, or a rule that work lives on the server.
- An alert when a backup doesn't finish, sent to someone who will read it.
- A monthly restore test with a written result.
- A written note of how long a full rebuild takes, so you know before you need to.
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a web design and software company in Myrtle Beach, South Carolina.