3-2-1 Backup: the rule and its ransomware trap

The 3-2-1 backup rule means you store three copies of your data on two different types of media, with one copy kept offsite or isolated. For example, you might have your working file on a laptop, a backup on an external hard drive, and another backup in a cloud service that is not automatically synced. The key contrast is that cloud sync services like Dropbox or OneDrive are not true backups because if you delete a file or ransomware encrypts it, the change syncs to all copies, leaving you with no clean version.

To avoid common mistakes, remember that the '2 types of media' must be physically different, such as a hard drive and a tape, or a hard drive and a cloud service that stores data on separate infrastructure. Do not count two partitions on the same drive as different media. Also, the offsite copy should be in a different physical location or air-gapped, meaning it is not connected to the network when not in use. A quick elimination trick: if a question offers 'cloud sync' as a backup method, check whether it mentions versioning or point-in-time recovery; without that, it is not a backup.

A compact way to test yourself: imagine ransomware hits your computer. If all your copies are reachable from the same network, you fail the 3-2-1 rule. The offsite copy must be immune to that attack, so think 'one copy that ransomware cannot touch.'