Your Backup Is Probably Useless. Here's Why.
Every company I talk to says the same thing: "Of course we have backups." And then I ask the follow-up question: "When was the last time you tested a full restore?" The silence that follows tells me everything I need to know.
Having backups and being able to restore from them are two completely different things. I've seen companies that religiously ran nightly backups for years, only to discover during a ransomware attack that the backup software had been silently failing for months. The log files showed errors. Nobody checked the log files.
Others had working backups—on a NAS in the same server room. The ransomware encrypted those right along with everything else. Some had offsite backups, but the restore process took so long that the business had essentially ceased operating by the time systems were back online.
Backups are your last line of defence. If everything else fails—firewalls breached, antivirus bypassed, employees deceived—your backup is what stands between "bad week" and "company goes under." It needs to work. Not theoretically. Not probably. Actually work, tested and proven, when you need it most.
The 3-2-1-1-0 Rule: Your Backup Bible
The classic 3-2-1 rule has been around for decades: three copies of your data, on two different media, one copy offsite. Good advice, but no longer sufficient against modern ransomware.
The extended rule adds two crucial elements. The first "1" stands for one copy that's either offline or immutable—meaning it cannot be changed or deleted, not even by an administrator, not even by ransomware with admin privileges. This is your insurance policy against the worst-case scenario: an attacker who has full control of your systems.
The "0" stands for zero errors in your restore tests. Not "we hope it works," but "we proved it works, last Tuesday, and here's the documentation." Regular restore tests are the difference between a backup strategy and a backup fantasy.
Immutable Backups: The Game Changer
Traditional backups can be deleted or encrypted by anyone (or anything) with sufficient permissions. Immutable backups cannot. Once written, they're locked for a defined retention period—whether that's 14 days, 30 days, or a year. No admin can delete them, no ransomware can encrypt them, no disgruntled employee can wipe them.
Most modern backup solutions support immutability: Veeam with hardened repositories, Azure Immutable Blob Storage, AWS S3 Object Lock. The technology exists and is mature. The only thing it requires is the decision to implement it.
The cost difference is minimal—typically 10-20% more than standard backup storage. For the protection it provides, that's a remarkably cheap insurance policy.
How Often, How Long, How Fast?
Three questions every backup strategy must answer.
How often do you back up? That depends on how much data you can afford to lose. If your RPO (Recovery Point Objective) is 24 hours, nightly backups suffice. If losing a day's worth of orders is unacceptable, you need more frequent backups—every four hours, every hour, or continuous replication for truly critical systems.
How long do you keep backups? This depends on compliance requirements and business needs. Financial data in Germany has a 10-year retention requirement. For most operational data, 30-90 days of daily backups plus monthly backups for a year is a sensible baseline. Keep in mind that ransomware sometimes lies dormant for months before activating—your retention period needs to extend beyond that window.
How fast can you restore? This is the RTO (Recovery Time Objective), and it's the number that matters most in a crisis. Can you get your critical systems back within four hours? Eight hours? Twenty-four? The answer determines which technology you need. Tape backup with offsite storage? Slow but cheap. Disk-based backup with local copies? Fast but more expensive. Cloud-based disaster recovery with automated failover? Fastest, but premium-priced.
The Restore Test: The Part Everyone Skips
I cannot stress this enough: a backup that hasn't been tested is not a backup. It's a hope. And hope is not a strategy.
Schedule quarterly restore tests. Not just "did the file copy back," but full scenario tests: your main server is gone, your database is corrupted, your file server is encrypted. Can you get operations running again? How long does it take? What's missing?
Document everything. The restore procedure, the time it took, any issues encountered, the lessons learned. This documentation becomes your recovery playbook—the guide that someone follows at 3 AM when things go wrong and nobody can think straight.
And here's a pro tip: do your first restore test without telling the IT team in advance. See what happens when the alarm goes off for real. The results are usually illuminating—and always lead to improvements.
Cloud Backup: The Modern Offsite
Forget tapes in a safe deposit box. Cloud backup has become the standard for offsite storage, and for good reason: it's automated, it's encrypted, it's geographically separated, and it scales without you buying hardware.
Azure Backup, AWS Backup, Veeam Cloud Connect—all provide reliable offsite replication with end-to-end encryption. The data sits in a different datacenter, in a different city, managed by a provider with security resources you couldn't match internally.
The key consideration: bandwidth. Your first full backup to the cloud can take days or weeks, depending on data volume and internet connection. After that, incremental backups typically work fine over standard connections. But factor the initial sync into your timeline.
The Backup That Saved the Company
Let me end with a story. A client of ours—a manufacturing company with about 80 employees—got hit by ransomware on a Friday evening. By Saturday morning, every server was encrypted, every workstation locked out. Production stopped. The attackers demanded €300,000.
But we'd implemented immutable backups six months earlier. The ransomware couldn't touch them. By Sunday evening, critical systems were restored. By Monday, the company was operational. By Wednesday, everything was back to normal.
The total cost of the incident: one lost weekend and the overtime for the recovery team. The alternative—without those backups—would have been catastrophic.
That's the ROI of a proper backup strategy. Not in a spreadsheet, but in the survival of the company.
*We design backup strategies that actually work—tested, documented, and ransomware-proof. Schedule a conversation*
