Cybersecurity

What backup strategy defends against ransomware?

Learn backup strategies that protect against ransomware, including 3-2-1 backup rules and air-gapped storage.

By Inventive HQ Team2025-01-26

The backup strategy that actually defends against ransomware is the 3-2-1-1 rule: 3 copies of your data, on 2 different media types, with 1 copy offsite — plus at least 1 copy that is immutable or air-gapped, meaning ransomware physically or logically cannot reach it. The classic 3-2-1 rule alone is not enough against modern ransomware: attackers now actively hunt for backup shares, cloud sync targets, and backup admin credentials, and Sophos found they attempt to compromise backups in roughly 94% of ransomware attacks. If every copy you have is reachable from a compromised network, "3 copies" can become "0 usable copies" in the same incident. The fourth element — an offline, air-gapped, or write-locked immutable copy — is what turns a backup plan into an actual ransomware defense.

The rest of this article covers what makes a backup ransomware-resistant in practice, how to size your retention window against real attacker dwell time, which backup tier to use for what, and the specific failure patterns that quietly leave "backed up" organizations exposed anyway.

Two live, network-reachable copies get encrypted. The offline/immutable copy is the one you actually recover from.

Backup Strategy for Ransomware Defense

The most effective ransomware defense is reliable, ransomware-resistant backups. Even if ransomware encrypts every production system, you can wipe and restore from a clean copy and avoid paying a ransom entirely — but only if at least one of your backup copies was never reachable by the attacker in the first place. That last condition is where most "we have backups" organizations actually fail.

The 3-2-1-1 Backup Rule

3: Keep 3 copies of data

Original production data
Local backup copy (fast recovery)
Offsite backup copy (disaster recovery)

2: Store on 2 different media types

Hard drives and tape OR
Internal and external storage OR
Cloud and on-premises

1: Keep 1 copy offsite

Physically separated from main location
Different cloud region OR
Different city/country

+1: Keep 1 copy immutable or air-gapped

Object-locked cloud storage (S3 Object Lock, Azure Immutable Blob) OR
Offline tape or disk in a vault, disconnected outside the backup window OR
Snapshots with a retention lock the backup admin account cannot override

Why the original 3-2-1 rule alone isn't enough: it was designed for hardware failure, fire, and theft — not for an adversary that logs in with stolen credentials and goes looking for your backups on purpose. Sophos's ransomware research found attackers attempted to compromise backups in about 94% of attacks, and organizations whose backups were compromised paid ransoms far more often, at roughly double the median demand, than those whose backups survived. If your "3 copies on 2 media types, 1 offsite" are all reachable from a domain-joined, network-connected system, ransomware can often reach all of them in the same incident. The +1 — a copy that's genuinely immutable or air-gapped — is the part that actually stops that from happening.

Why the rest of it still works:

3 copies protect against primary and secondary failure
Different media prevent single technology failure
Offsite copy protects against location disaster (fire, theft)
The immutable/air-gapped copy is the one ransomware can't touch, encrypt, or delete

Which Backup Tier Should You Actually Use?

No single tier is sufficient on its own — a real strategy layers several. Here's how the common tiers compare and where each one fits:

Backup Tier	Recovery Speed (RTO)	Ransomware Resistance	Relative Cost	Use It For
Local / on-prem disk (NAS)	Minutes to hours	Low — same network, often reachable and encrypted first	$	Day-to-day recovery: accidental deletes, hardware failure. Never your only copy.
Offsite / cloud (continuous sync)	Hours	Low-Medium — reachable via stored credentials or API access unless locked down	$$	Site-loss disaster recovery. Pair with object lock/versioning — sync alone isn't ransomware protection.
Immutable cloud object storage (WORM / object lock)	Hours	High — can't be altered or deleted by anyone, including a compromised admin, until the lock expires	$$	Your primary ransomware-specific recovery point. Set the lock duration at or beyond your longest plausible dwell + detection time.
Air-gapped / offline (tape, vaulted disk)	Hours to a day or more	Highest — no live network path exists for ransomware to follow	$$-$$$	The "+1" copy. Slowest to restore from, but the one guaranteed clean when everything else is encrypted.

Open the Interactive Ransomware Resilience Assessment toolFree, in your browser on inventivehq.com →

Loading interactive tool...

JavaScript Required

This interactive tool requires JavaScript to function. Please enable JavaScript in your browser to use the full features.

The tool description and documentation above provide information about this tool's capabilities. For the best experience, please enable JavaScript and refresh the page.

Critical Backup Characteristics for Ransomware

Advertisement

1. Air-Gapped/Offline Storage

Control: Backups not accessible from network during normal operations

Methods:

USB drives stored in vault (physically disconnected)
Tape backups offline storage
Cloud snapshots with no network access during window
Backup servers physically isolated

Why essential: Ransomware can't delete offline backups

2. Immutable Backups

Control: Backups can't be modified or deleted even by admin

Implementation:

WORM (Write Once Read Many) tape
Cloud object lock (S3, Azure)
Snapshots with retention policies
Separate admin accounts for backup management

Why essential: Prevents attacker/insider deleting backups

3. Incremental Backups with Full Retention

Strategy:

Full backup: Weekly
Incremental: Daily
Keep multiple full generations (e.g., 4+ weeks)

Why essential: Can recover to any point in time pre-attack — but only if your retention window is deeper than the attacker's dwell time plus however long it takes you to detect the breach.

Incident response data shows ransomware dwell time — the gap between initial compromise and the attacker actually triggering encryption — has compressed sharply in recent years. Mandiant's M-Trends 2025 report put the median dwell time for ransomware-related intrusions at 6 days overall (5 days when the adversary itself tips off the victim, e.g. via a ransom note, versus 29 days when the intrusion is found internally), while Sophos and Halcyon data point to a median closer to 4 days by late 2024. The range matters less than the conclusion: attackers can go from initial access to encryption in under two weeks, and a shallow retention window can roll straight past your last clean backup before you even know you've been breached.

7-day retention clean copy already gone ✕

30-day retention covers a clean, pre-compromise restore point ✓

4. Rapid Recovery Capability

Measure: How quickly can you restore?

RTO (Recovery Time Objective): 4-24 hours
RPO (Recovery Point Objective): <24 hours

Implementation:

Pre-staged recovery infrastructure
Regular restoration testing
Documented procedures
Trained staff

Backup Architecture Example

Day 1 (Monday):   Full backup → Cloud (immutable copy)
Day 2 (Tuesday):  Incremental → Local storage
Day 3 (Wednesday): Incremental → Local storage
Day 4 (Thursday):  Incremental → Local storage
Day 5 (Friday):    Full backup → Tape (offline vault)
Day 6-7:          Weekly offsite transport

Attack occurs Day 3:
- Can restore from Day 1 full backup
- Can restore from Day 2 incremental
- Can restore from Day 1 tape backup
- Never used ransomware-encrypted Day 3 incremental

Testing and Validation

Critical: Actually test restoration

Monthly: Test backup restoration
Quarterly: Full recovery drill
Yearly: Full failover test

What to test:

Backup completes successfully
Backup not corrupted
Can restore to different hardware
Recovery time acceptable
Data integrity verified

Ransomware-Resistant Backup Best Practices

DO:

Keep offline copies disconnected from network
Test restoration monthly
Implement immutable backups
Store backups geographically dispersed
Maintain separate backup admin accounts
Monitor backup integrity
Document recovery procedures
Educate team on backup importance

DON'T:

Use only online backups (ransomware deletes them)
Skip testing (untested backups often fail)
Allow admin access during critical windows
Store all copies in same location
Make backups visible on infected network
Automate backup deletion without safeguards
Assume cloud backups are protected

Common Backup Failures That Leave Organizations Exposed

Most organizations that get hit with "our backups were encrypted too" didn't lack a backup strategy on paper — they had a gap in how it was implemented. These are the patterns that show up repeatedly in ransomware post-mortems:

Symptom	Likely Cause	Fix
Backups were encrypted along with production data	Backup share was mapped/always-on and reachable using domain credentials	Move to immutable object storage or an offline/air-gapped rotation; don't domain-join the backup target
Backup job shows "success" but restore fails	Backups were never actually tested — only job-completion status was checked	Run monthly test restores, not just green checkmarks on a dashboard
A restore point exists but the data is already compromised	Retention window is shorter than the attacker's dwell time	Extend retention to weeks, not days, so a pre-compromise point still exists once the breach is detected
Backup jobs were disabled or deleted before encryption hit	Backup admin console shared credentials/domain with production, no MFA on backup admin accounts	Separate backup administration from domain admin; enforce MFA and least privilege on backup consoles
Cloud backup was lost too	Versioning/object lock wasn't enabled, so continuous sync overwrote clean versions with encrypted ones	Enable object lock/WORM and immutability — "backed up to the cloud" isn't the same as ransomware-resistant
Recovery technically works but takes days longer than planned	No pre-staged recovery infrastructure or rehearsed runbook	Pre-stage recovery environment and rehearse the full runbook end-to-end, not just individual file restores

Cost-Benefit Analysis

Investment: Roughly $50K-$200K annually for a robust, layered (local + cloud + immutable/air-gapped) backup strategy at the SMB-to-midmarket scale, depending on data volume and retention depth.

Cost of a ransomware attack without recoverable backups: Sophos's 2025 State of Ransomware research put the average cost to recover from a ransomware attack — excluding any ransom payment — at roughly $1.5 million (down from about $2.7 million in 2024, but still a massive gap versus the cost of prevention). That figure climbs further for organizations whose backups were also compromised: Sophos found those victims paid ransoms far more often, and at a median demand roughly double that of organizations whose backups survived intact.

ROI: A ransomware-resistant backup program that costs tens of thousands to low hundreds of thousands annually is a rounding error against a $1.5M+ average recovery cost — the payback on a single avoided incident typically covers years of the program.

Conclusion

Ransomware-resistant backup strategy must provide:

Multiple copies, on multiple media, with one offsite (the 3-2-1 foundation)
At least one immutable or air-gapped copy ransomware genuinely cannot reach (the +1)
Retention deep enough to outlast attacker dwell time
Rapid, pre-staged recovery capability
Regular, real restoration testing — not just job-success checks

Organizations with strong backup strategies can restore from ransomware attacks without paying ransoms, making attacks unprofitable for attackers.

Frequently Asked Questions

What is the 3-2-1 backup rule?

The 3-2-1 rule means keeping at least 3 copies of your data, on 2 different types of media, with 1 copy stored offsite. It protects against hardware failure, site disasters, and accidental deletion — but on its own it does not reliably protect against ransomware, because modern ransomware actively searches the network for backup shares and cloud sync targets and encrypts or deletes them before finishing the job on production systems. That's why the modern standard adds a fourth requirement: at least one of those copies must be immutable or air-gapped, giving you a 3-2-1-1 strategy.

Is the 3-2-1 rule enough to stop ransomware?

Not by itself. The 3-2-1 rule was designed for hardware failure and disasters, not for an adversary that is actively hunting for your backups. In Sophos's State of Ransomware research, attackers attempted to compromise backups in 94% of ransomware incidents, and victims whose backups were compromised paid ransoms far more often and at roughly double the median demand of those whose backups survived. If all 3 copies sit on systems reachable from a compromised network — even if they use different media or locations — ransomware can often reach and encrypt or delete every one of them. You need at least one copy that is immutable (can't be altered or deleted, even by an admin account) or fully air-gapped (physically or logically disconnected from the network).

Can ransomware encrypt backups?

Yes, and it routinely does. Modern ransomware is written to specifically search for mapped drives, backup software agents, NAS shares, and cloud storage credentials, then encrypt or delete anything it finds before or alongside the main encryption event. Sophos reported that cybercriminals attempted to compromise backups in 94% of ransomware attacks in 2024, and by 2025 the share of victims able to actually use backups to restore had dropped to roughly half of incidents — the lowest rate in six years. The only backup copies ransomware reliably cannot reach are ones that are immutable (locked against modification/deletion for a set retention period) or genuinely offline/air-gapped.

What is immutable backup storage?

Immutable backup storage is storage where, once a backup is written, it cannot be modified, encrypted, or deleted by anyone — including an administrator or an attacker with stolen admin credentials — until a retention lock expires. It's typically implemented with WORM (Write Once, Read Many) policies, cloud object lock (Amazon S3 Object Lock, Azure Immutable Blob Storage), or vendor snapshot retention that can't be shortened even by the backup admin account. Immutability matters specifically against ransomware because most attacks now include an attempt to delete or encrypt backups using compromised credentials — a lock the attacker's account can't override defeats that step entirely.

What is an air-gapped backup?

An air-gapped backup is a copy that is physically or logically disconnected from the network during normal operations, so nothing running on the network — including ransomware — can reach it. Classic examples are tape cartridges stored in an offsite vault, external drives that are only connected briefly for a backup window and then disconnected, and backup targets with no persistent network path or credentials shared with production systems. Air-gapped backups are typically the slowest tier to restore from, but they're also the hardest for ransomware to touch, which is why they're the recommended "+1" in a 3-2-1-1 strategy.

How often should backups be tested?

Test restores monthly at minimum, run a fuller recovery drill quarterly, and do a full failover/DR test annually. A backup job reporting "success" only confirms that data was written somewhere — it says nothing about whether that data can actually be restored to working systems within your recovery time objective. Untested backups fail silently far more often than IT teams expect, and the first time most organizations discover a backup is corrupted, incomplete, or missing critical dependencies is during an actual ransomware recovery, which is the worst possible time to find out.

How long should you retain backups to survive ransomware?

Deep enough that a clean, pre-compromise restore point is still inside your retention window by the time you detect the attack — in practice, that generally means weeks of retention, not days. Incident response data shows attacker dwell time (from initial access to launching encryption) has compressed significantly in recent years, with several 2024-2025 reports placing the median in the single digits to low double digits of days, but detection and full investigation can still take longer. A 7-day retention window can roll past the compromise date before you even know you've been breached, silently deleting your last clean copy. Retaining multiple weekly full backups plus daily incrementals gives you options even if the most recent points are compromised.

What is the difference between backup and disaster recovery?

Backup is the copy of your data; disaster recovery is the complete plan and infrastructure for getting the business back online using that copy, measured by recovery time objective (RTO) and recovery point objective (RPO). You can have perfect backups and still fail at disaster recovery if you have no pre-staged infrastructure to restore to, no documented runbook, and no rehearsed process — restoring a database is not the same as restoring a functioning, integrated business. Backup strategy is a necessary input to disaster recovery, not a substitute for it.

Should I pay the ransom if my backups are also encrypted?

Paying does not guarantee a working decryptor, does not undo data theft if the attacker also exfiltrated data, and funds the next attack — but if backups are genuinely destroyed and there's no other path to recover critical, irreplaceable data, some organizations still end up weighing it as a last resort. This is exactly the scenario ransomware-resistant backup strategy exists to avoid: Sophos found organizations whose backups were compromised paid ransoms at a much higher rate and a substantially higher median amount than those whose backups survived intact. An immutable or air-gapped copy is what keeps this from ever becoming a real decision.

How much does ransomware-resistant backup infrastructure cost?

Budget roughly in the tens of thousands to low hundreds of thousands of dollars annually depending on data volume, retention depth, and how many tiers (local, cloud, immutable, air-gapped) you run — small compared to the cost of an attack without recoverable backups. Sophos's 2025 State of Ransomware research put the average cost to recover from a ransomware attack, excluding any ransom payment, at roughly $1.5 million; adding immutable object storage or an air-gapped rotation on top of an existing backup platform is typically a modest incremental cost against that exposure, not a rebuild from scratch.

ransomwarebackup strategydisaster recoverybusiness continuity

Advertisement

Interactive Ransomware Resilience Assessment

From the Inventive HQ family

OmniCanvas Notes

Visual thinking on an infinite canvas.

Notes, sketches and ideas laid out spatially instead of in a list. For people who think in diagrams and keep outgrowing linear note apps.