The 3-2-1 Backup Rule and Ransomware: How to Explain It to the Customer

Ransomware attacks have become one of the most common cyber incidents organisations face. Attackers now try to encrypt not only production data but also backups. Being able to explain the right backup architecture to your customer wins trust and recurring revenue for you as a reseller.

What is the 3-2-1 rule?

There should be 3 copies of the data (1 production, 2 backups), stored on 2 different media (for example disk and cloud), with 1 copy off-site. The modern approach is the "3-2-1-1-0" rule: 1 copy should be immutable or air-gapped, and restore tests should have zero errors.

Two critical concepts: RPO and RTO

• RPO (recovery point objective): how much data loss is acceptable at most? With a daily backup the RPO is 24 hours.
• RTO (recovery time objective): how soon must the system be back up at the latest?

For an accounting server an RPO of 24 hours and an RTO of 8 hours may be enough, while an e-commerce database may need an RPO of 15 minutes and an RTO of 1 hour. These two numbers shape the quote.

Example architecture and sizing

Consider an SME with 5 TB of production data: 1. Primary backup: a local NAS; with 5 TB of raw data, about 9 TB of usable space for 30 days' retention with daily incrementals. 2. Secondary backup: a cloud target; with 20 percent yearly data growth, about 6 TB within 12 months. 3. Immutable copy: 14 days of immutable retention on the cloud side.

This architecture gives three separate protections against local disk failure, fire or theft, and ransomware.

How to explain it to the customer

• Stress the difference between "I took a backup" and "I can restore it"; suggest a restore test every three months.
• Show that the backup is protected by a separate permission rather than an account that can write to the production network.
• Compare the cost with the daily loss of a possible production stoppage.

The sales opportunity

Backup gives the reseller recurring revenue through annual licences and cloud storage subscriptions. Backup audits, restore tests and monitoring can become additional managed-service revenue. Licences for products such as Nimbra are managed per user and capacity in the Bayit portal.

Frequently asked question

Is a cloud backup enough? Not on its own. When the internet connection is down, or a restore needs a very large volume of data, the local copy gives fast recovery; that is why a hybrid architecture is recommended.