Why Your Backups Are Ransomware Bait: The 3-2-1-1-0 Fix

“Why do I need more than one backup copy?”

You’ve heard the 3-2-1 rule: three copies of your data, on two different media, one off-site. That’s fine for a house fire. It’s not fine for ransomware. Attackers don’t just hit your primary data—they hunt for your backups too. NIST SP 800-209 calls this out bluntly: attackers target backups and may even poison future copies by interfering with the backup process itself.

So the old rule is dead. The modern version is 3-2-1-1-0: three copies, two media, one off-site, one immutable or air-gapped, and zero unverified backups. That “0” is the part most people skip. You can have three copies, but if you’ve never tested a restore, you have zero usable backups.

“What’s the difference between a snapshot and a backup?”

This is the biggest misconception I see. A snapshot is a point-in-time copy, but it’s not a backup in the sense you can rely on it alone. NIST defines a snapshot as a storage-efficient copy that stores only changed blocks—it’s fast and cheap, but if the source data is unavailable, the snapshots often are too. That means if ransomware encrypts your primary storage, and your snapshots live on the same system, you’re toast.

Snapshots are useful for quick recovery, but they’re not a substitute for a real backup. NIST SP 800-209 says snapshots should be configured to meet your RPO—if you can only lose five minutes of data, snapshot every five minutes—but they also recommend treating snapshots as part of a broader data protection plan, not the whole plan.

“How do RPO and RTO affect my backup software choices?”

RPO (Recovery Point Objective) is how much data you can afford to lose, measured in time. RTO (Recovery Time Objective) is how fast you need to be back online. They’re different, and they drive your backup strategy. Mission-critical systems often get an RTO under one hour and an RPO under five minutes, while less critical systems can tolerate longer.

Your backup software should let you set these targets per system, not just a blanket schedule. NIST SP 800-34 says the RTO must be shorter than your Maximum Tolerable Downtime, and it’s not part of that downtime—it’s a separate limit on data loss. So when you pick a tool, ask: can it do continuous backup for critical databases, and can it restore to a different point in time without a full rebuild?

Here’s a concrete example: if your RPO is five minutes, you can’t rely on nightly full backups. You need something like continuous data protection (CDP), which NIST describes as transmitting changed blocks continuously and journaling them, giving you fine-grained recovery. If your software only does daily incrementals, you’re already outside your RPO.

“Do I need to test my backups? How often?”

Yes, and more often than you think. NIST SP 800-209 recommends testing backups at least monthly for critical data, and doing an end-to-end test restore to a sandbox environment if you have strict restoration speed requirements. That’s not a suggestion; it’s a survival tactic.

The “0” in 3-2-1-1-0 means zero unverified backups. An untested backup is an assumption—and assumptions get you ransomware ransom demands. CISA’s ransomware guidance says to maintain offline, encrypted backups and regularly test them. But testing isn’t just clicking “restore” on a file. You need to verify the data is intact, the software actually restores it, and the restored system boots.

Quick tip: Keep a recovery catalog that logs each copy and the results of anti-malware scans. Periodically scan a subset of past copies with current anti-malware tools to catch poisoned backups before you need them.

“What’s the deal with immutable and air-gapped backups?”

Immutable means data can’t be altered or deleted after it’s written. Air-gapped means it’s physically or logically isolated from your network. Both are your defense against ransomware that tries to delete your backups. NIST SP 800-209 defines immutability as locking data after creation, and that’s exactly what you want for your last line of defense.

Some backup software includes immutable storage, but you have to configure it correctly. If your “immutable” copy is on the same network and uses the same credentials as your primary storage, it’s not really immutable. CISA’s #StopRansomware Guide, updated in 2023, specifically added guidance on cloud security backups, noting that cloud volumes should be snapshotted for forensic review—but that’s for incident response, not a recovery plan.

My recommendation: use the 3-2-1-1-0 rule as your checklist. That means at least one copy that is either immutable or air-gapped, and zero backups you haven’t tested. If your backup software can’t do that, switch. It’s not a luxury; it’s the only way to survive a modern ransomware attack.

The single most important thing to remember: The 0 in 3-2-1-1-0 is the rule that saves you. Test your backups monthly, and keep one copy that ransomware can’t touch. That’s your real backup.

Sources

• CISA (data backup guidance) - https://www.cisa.gov/stopransomware
• NIST SP 800-209 (Storage Infrastructure Security) - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• NIST SP 800-34 Rev. 1 (Contingency Planning Guide) - https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
• CISA #StopRansomware Guide (resource page) - https://www.cisa.gov/resources-tools/resources/stopransomware-guide