Ransomware operators changed their playbook years ago, and too many backup strategies never caught up. Modern attacks don't start by encrypting your file server — they start by finding and destroying your backups. Attackers routinely spend days or weeks inside a network before triggering encryption, and their first priorities are stealing data for double extortion and deleting every recovery path they can reach: backup servers, network shares full of backup files, cloud sync folders, even connected USB drives. When the ransom note finally appears, the victim discovers their "backups" died with everything else.
That's why the classic 3-2-1 backup rule grew two more digits. The modern standard is 3-2-1-1-0, and the two additions are precisely the ones that defeat ransomware.
What 3-2-1-1-0 means
3 — keep three copies of your data. Production plus two backups. One backup is a single point of failure wearing a disguise.
2 — on two different media or platforms. A backup server and a cloud repository; a NAS and object storage. Different platforms fail — and get attacked — differently.
1 — with one copy offsite. Fire, flood, and theft are still real. Offsite today usually means cloud, which is fine — with the caveat below.
1 — with one copy immutable or offline. This is the ransomware killer, covered in depth next.
0 — with zero errors, verified by testing. An untested backup is a hope, not a plan.
Most organizations we assess pass the first three digits and fail the last two. Those are the ones that decide whether you restore in hours or negotiate with criminals.
The "1": immutability, explained without vendor jargon
An immutable backup is a copy that nobody can alter or delete during its retention window — not an attacker with stolen admin credentials, not a rogue insider, not even you. It's the digital equivalent of a tape in a vault, but without the courier.
Practical ways to get it:
Object storage with object lock. S3-compatible storage (AWS, Wasabi, Backblaze B2, and others) supports write-once-read-many object lock. Configured in compliance mode, even the account root cannot shorten retention. This is the most accessible immutability for small and mid-sized businesses.
Hardened backup repositories. Modern backup platforms offer Linux-based hardened repositories where backups are written with immutability flags and management access is physically separated from production credentials.
Genuinely offline copies. Rotated disks in a safe, or tape. Old-fashioned, but air is still the best firewall. The discipline problem: humans stop rotating media. If your offline copy depends on someone remembering, it will eventually be six months stale.
The test is simple: if an attacker held every password in your company, could they destroy this copy? If the answer is yes, you don't have an immutable backup — you have a target.
One warning about cloud sync services: OneDrive, Dropbox, and Google Drive are not backups. Sync platforms faithfully replicate ransomware-encrypted files over your good ones within minutes. Versioning features help, but mass-restore across thousands of files is slow, partial, and was never designed as disaster recovery.
The "0": zero errors means actually testing restores
Backup jobs report success right up until the restore fails. Corrupted repositories, missed VMs, expired credentials, application-inconsistent database snapshots — every one of these hides comfortably behind a green checkmark for months.
A defensible testing program has three layers:
Automated verification on every job — checksum validation and, ideally, automated boot tests that spin the backup up in an isolated sandbox and confirm the OS actually starts.
Monthly spot restores — pick a file, a mailbox, a database table; restore it; confirm it opens. Fifteen minutes that regularly finds silent failures.
An annual full disaster recovery exercise — restore your critical systems to bare metal or a clean cloud environment and measure how long it really takes. The first time an organization runs this exercise, the measured time is typically three to five times longer than anyone predicted. Better to learn that on a calm Tuesday than mid-incident.
Testing also answers the two numbers your leadership actually cares about: RPO (how much data you can afford to lose — the gap between backups) and RTO (how long you can afford to be down — the restore time you've proven, not guessed). If the business expects four hours of downtime tolerance and your tested restore takes three days, that gap is a board-level finding, as our analysis of what downtime really costs makes painfully concrete.
Don't forget the data that isn't on your servers
Two blind spots show up in almost every assessment:
SaaS data. Microsoft 365 and Google Workspace operate on a shared-responsibility model: they guarantee the platform, you're responsible for the data. Retention policies and recycle bins are not backups — a compromised admin account can purge them. Third-party SaaS backup is inexpensive and closes the gap.
Endpoints and the odd critical laptop. The CFO's laptop with the only copy of the acquisition model is a recovery plan risk, not an IT inconvenience. Either enforce server/cloud storage of critical data or back the endpoints up directly.
A realistic architecture for a mid-sized business
Putting it together, a defensible design that doesn't require an enterprise budget:
Local backup appliance or server for fast operational restores (yesterday's deleted file, last week's VM).
Replication to immutable cloud object storage with compliance-mode object lock, 30 to 90 day retention.
SaaS backup for Microsoft 365 or Workspace.
Automated verification on every job, monthly spot restores, annual DR exercise — all documented.
Backup infrastructure on separate credentials, separate MFA, and ideally a separate identity domain from production. Your backup admin account is now the most valuable credential you own; treat it that way.
This architecture is also what cyber insurance underwriters increasingly require before they'll bind or renew a policy — immutable, tested, credential-separated backups have moved from best practice to eligibility requirement. It pairs with, but does not replace, a broader security-first culture: backups are the last line of defense, not the only one.
The bottom line
You cannot prevent every intrusion. You can make ransom payment pointless. When an attacker detonates and finds an immutable, tested, credential-isolated recovery path, the extortion math collapses — you restore, you notify, you move on.
Not sure your backups would survive contact with an attacker? YonderTech runs backup and disaster recovery assessments that test exactly that — including a live restore exercise with a written report. Schedule one before you need it.