The 3-2-1 backup rule has an obvious caveat that ransomware exploits very well.

Almost everyone should know about the 3-2-1 backup rule by now. If you don’t, it’s a good strategy to have three copies of your files on two different media, one off-site. Only then will your files be truly protected from accidents, or, as I recently learned, from most accidents.

See, there’s an important caveat to this strategy that people don’t talk about enough. Even if three copies of critical files, geographic separation, and snapshots are configured, ransomware (or similar malware) can remove the master copy and all backups at once. Fortunately, there is a cheap and simple way to solve this problem: cold storage backup.

Backups should not be set regularly

Malware can spread to all of them

I realized the backup loophole when I read about a paid program specifically targeting NAS systems. Instead of only touching files on your primary drive, many ransomware will spread to other installed storage, including backup drives and SMB shares, and encrypt files. The only way to make a backup in this scenario is if it is disconnected from the computer and inaccessible.

My setup has a backup drive on the system as well as the main storage. I use an rsync script that runs nightly to sync changes to another disk from my primary storage pool. This setup protects me from hardware failure and corrupted files, but if malware finds its way into my system, it can easily be replicated through additional copies of my files.

An off-site backup greatly strengthens this setup, but only if it’s not accessible from the same computer where the rest of the files reside. I set up the offsite backup as a mapped network drive and that was the whole problem. This makes backups easier and allows for convenient file browsing, but it’s also a double-edged sword, giving anything malicious on my computer a direct gateway to another copy of my random files.

This also applies to painting and other protective layers. If they are stored with a master copy of your files and the device is infected with ransomware or malware, they can also be attacked. My automated backup would spread the ransomware to other copies of my files if I was unlucky enough to get infected. This should be a convenient way to sync my files to a remote VPS, but if my main computer gets infected without my knowledge, a nightly offsite sync will overwrite my good copies with corrupted data.

A vented backup disk is a simple fix

Infections do not threaten your personal storage

The easiest ransomware protection is nothing short of amazing. I protect my files With the external drive offline and offline until I actively sync makes changes to the file. It’s as simple as plugging it in once a week, backing it up (I use the rsync command) and unplugging it again after the sync is complete. Here is the command I use:

rsync -avhP --delete /mnt/tank/files/ /mnt/external/backup/

Then I disconnect the drive and leave it until next week. There are plenty of other complicated solutions and ransomware detections you can implement, but I find the simplest fix to be the most elegant. Plus, it’s a cheap and simple fix that anyone can use, and it doesn’t rely on special technology or software. Cold storage also provides peace of mind because it doesn’t rely on carefully configured software to detect malicious activity. Just unplug it and forget about it.

It’s so simple that it doesn’t need to be perfect

Live files and cold storage are not always synchronized

If I ever have to resort to restoring my files from a device with air, they may be slightly out of sync with the files on the main storage. For example, if I make a backup of the last partitioned device five days ago, and go to restore from it, I lose the last five days of file changes. That’s very little negotiation, all things considered. If every copy of my files except the external drive is corrupted, I’m not worried about a few days worth of changes.

So far I haven’t been infected with ransomware or anything like that. I take the usual precautions online, so the chances of anything happening are relatively small. An external drive gives me enough protection that in the unlikely event something happens, the slight gap in file sync is an acceptable drawback. I could always back up more often if I was worried about additional file changes being too far behind.

Get a copy like nothing else can

If you’re following a 3-2-1 backup strategy (and you should be), but haven’t considered a ransomware attack, an external drive is the simplest solution to start using today. Installation takes almost no time and ensures that you always have an extra copy of your files in your desk drawer in case you delete any other copy.