Backups that actually work

A backup is a promise you test

A backup is a spare copy of your data you can go back to if the original is lost, locked or destroyed. But a copy you have never checked is only a promise. The question that matters is not "do I have a backup?" but "if I needed it right now, would it actually bring my files back?"

Recent and tested, not just present

Two things decide whether a backup saves you.

• Recent: a backup from six months ago brings you back to six months ago. The more often your data changes, the more often it should be copied. For most people, automatic daily or weekly backups are about right.
• Tested: a backup you have never restored might be incomplete, out of date or corrupted, and you would only find out on the worst day. Every so often, actually restore a file or two from it and confirm they open.

Why backups protect availability

Security people talk about protecting three things: keeping data private, keeping it accurate, and keeping it available when you need it. Backups are mainly about that third one. A device can be stolen, a disk can fail, a file can be deleted by accident. A good backup means the data is still there, so an accident becomes an inconvenience instead of a disaster.

A common guide is the "3-2-1" idea: keep three copies of anything important, on two different kinds of storage, with one copy kept somewhere else. That "somewhere else" copy is what survives a fire, a theft or a flood at home or in the office.

Backups and ransomware

This is where backups earn their keep. Ransomware is malicious software that locks up your files and demands payment to unlock them. If your only copy is the one now encrypted, you are stuck choosing whether to pay criminals with no guarantee.

With a good, recent backup that the ransomware could not reach, the story changes. You can wipe the infected device and restore your files, without paying anyone. For this to work, at least one backup must be kept offline, or otherwise out of the reach of a device that gets infected, because ransomware will try to encrypt any backup it can see.

What to remember

• A backup counts only if it is recent and you have tested a restore.
• Backups mainly protect availability: your data survives loss, theft or failure.
• Keep at least one copy out of reach, so ransomware cannot take your safety net along with everything else.