Backup: Part 2 — The 3-2-1 Rule and Its Modern Variant

The most well-known backup scheme is the “3-2-1” rule. It was formulated by photographer Peter Krogh in a book about storing digital archives, and since then it has become widely accepted in IT. The rule is simple and significantly reduces the risk of losing data.

What is the “3-2-1” rule

The rule prescribes:

• 3 — have at least three copies of the data: the original and two backups;
• 2 — store the copies on at least two different types of media or in two different storage systems, for example on an external drive and in the cloud;
• 1 — keep at least one copy offsite.

More about each item

Three copies

Two types of media

Examples of combinations:

• internal SSD and external hard drive;
• tape drive and cloud storage;
• network-attached storage (NAS) and cloud.

Different media have different failure modes, so a single fault or error won’t destroy all copies at once.

One copy offsite

Options:

• cloud storage, for example Yandex Object Storage or Backblaze B2;
• a remote server or VPS;
• a physical medium stored in another building.

A remote copy protects against fire, flooding, theft and other incidents after which local copies may be lost along with the original.

The “3-2-1-1-0” rule

Ransomware increasingly searches for and destroys backups it can reach over the network. Therefore, an extended variant of the rule is now widely used — “3-2-1-1-0”:

• another 1 — one copy should be disconnected from the network or protected from modification and deletion (an immutable copy). It cannot be erased even with a stolen administrator account;
• 0 — zero errors on restore: backups must be regularly verified by restoring data from them, otherwise their usability remains an assumption.

Advantages

• Fault tolerance. Data survives hardware failure, employee error, and incidents at the office.
• Choice of recovery method. A local copy allows fast recovery; a remote copy — even after total loss of the office.
• Simplicity. The rule is easy to explain and to verify.

How to apply the rule in a small company

1. Original:
   • files on work computers;
   • databases on a server.
2. Local copy:
   • an external drive with automatic copying (for example, Time Machine on Mac or “File History” in Windows);
   • network-attached storage with a RAID array. RAID protects against a single disk failure, but is not itself a backup: a deleted or encrypted file will disappear from all disks in the array at once.
3. Remote copy:
   • cloud storage;
   • rotating external drives, where one of them is always kept offsite.

You can start small: an external drive and cloud storage already provide protection significantly better than having no backups. The main thing is to regularly check that data can actually be restored from the copies.