Estimated reading time: 10 minutes · Best for: IT Managers, Infrastructure Engineers, Operations Managers, Business Owners, CTOs
Note: the scenarios in this article are composite and hypothetical, built from widely reported ransomware incident patterns. They do not describe any specific named company or real event.
One Morning Can Change Everything
Most organisations never expect ransomware to become their problem. Security awareness training has been completed. Endpoint protection is installed. Backups appear to be running every night. Everything looks healthy — until one ordinary morning when employees arrive at work and discover that shared folders no longer open, databases refuse connections, and every file has been renamed with an unfamiliar extension.
The answers to the questions that follow — can we recover, how much have we lost, should we even consider paying — are rarely determined during the attack itself. They're usually determined months earlier, by decisions made during infrastructure and backup planning.
Why Ransomware Remains One of the Biggest Business Risks
Modern ransomware attacks have evolved well beyond simple file encryption. A typical attack chain may include credential theft, privilege escalation, lateral movement across the network, data exfiltration, backup discovery, backup deletion, encryption, and extortion. Attackers deliberately search for backup repositories because a business with a working backup is far less likely to pay a ransom — which is exactly why backup infrastructure has become one of the primary targets during modern cyber incidents.
Understanding the 3-2-1 Backup Strategy
Three copies of your data — the live production data, a primary backup, and a secondary backup.
Two different storage types — for example, production NVMe storage plus object storage, or a mix of local and cloud storage, so a single hardware or software failure can't affect every copy.
One copy stored off-site or offline — genuinely isolated, not simply another server permanently connected to the same production network.
The isolation requirement is the step most organisations misunderstand. If ransomware compromises administrative credentials, attackers may also reach any backup system that shares those same credentials and network access. A properly isolated backup remains inaccessible even if production infrastructure has been completely compromised, through air-gapped backups, immutable storage, or object storage with retention policies.
Backup Is Not the Same as Disaster Recovery
Backups answer one question: can we recover our data? Disaster recovery answers a different one: how quickly can the business return to normal operations? A complete disaster recovery strategy considers Recovery Time Objective (RTO), Recovery Point Objective (RPO), infrastructure rebuild procedures, network recovery, identity services, and incident response planning. Backups are one essential component of disaster recovery, not the whole strategy.
Scenario One: When Backups Fail at the Worst Possible Moment
Picture a growing UK professional services company with around fifty employees. Nightly backups run reliably to a network-attached storage device in the same office, reporting success every time. When an attacker gains access through a compromised remote-access account, ransomware spreads overnight across workstations and shared storage — and the backup device, sharing the same network and administrative credentials, is encrypted along with everything else. Nothing about the backup process failed technically; the architecture simply never separated production and backup into different failure domains.
Scenario Two: When Backups Exist but Recovery Still Fails
A different pattern: a growing software company backs up every production server automatically to an off-site cloud repository, with daily reports showing success. When ransomware strikes and the team attempts a full restore, they discover a critical database migrated to a new server months earlier was never added to the backup policy. The backup existed. The restore process worked. The data the business actually needed simply wasn't in it — a gap that only routine restore testing would have caught.
Scenario Three: A Business That Refused to Pay
Now picture an organisation with a more disciplined recovery strategy: local backups for rapid operational recovery, immutable off-site backups, quarterly recovery testing, documented procedures, and separated administrative credentials. When ransomware reaches part of the production environment, the response is procedural rather than chaotic — isolate affected systems, confirm the immutable backup is untouched, restore from a known-good point. The business loses a working day, not a working month, and never considers paying because a tested recovery path already exists.
Why Immutable Backups Have Become Essential
Traditional backups were designed to protect against hardware failure and accidental deletion. Modern ransomware has changed that assumption — attackers now actively search for backup servers, snapshot repositories, and backup software credentials, aiming to destroy the recovery path before encryption even begins. Immutable storage prevents backup data from being modified or deleted until a predefined retention period expires, so even compromised administrative credentials can't touch protected recovery points.
| Backup Type | Primary Purpose | Protection Level |
|---|---|---|
| Standard backup | Data recovery | Low against ransomware |
| Off-site backup | Protects against local disasters | Moderate |
| Immutable backup | Prevents modification or deletion | High |
| Air-gapped backup | Physically or logically isolated | Very high |
The Evolution from 3-2-1 to 3-2-1-1-0
Many security professionals now extend the traditional rule into the 3-2-1-1-0 approach, adding one immutable or air-gapped copy specifically resistant to compromised production credentials, and a standard of zero backup errors — meaning every scheduled backup completes successfully and restore testing confirms the data is actually usable, not just present.
UK Guidance and Compliance Alignment
UK organisations don't need to build a ransomware recovery strategy from scratch — established guidance already exists. The National Cyber Security Centre (NCSC) publishes practical recommendations on ransomware resilience and offline backup practices, and the Cyber Essentials certification scheme provides a baseline set of controls that many UK businesses are increasingly expected to demonstrate to clients, insurers, and public-sector procurement processes. Aligning a 3-2-1 backup strategy with NCSC guidance also tends to simplify UK GDPR conversations around data availability and business continuity, since regulators and auditors are generally looking for the same fundamentals: tested recovery, documented procedures, and demonstrable resilience against data loss.
Recovery Time Objective (RTO) vs Recovery Point Objective (RPO)
RTO defines how quickly services must be restored — an internal reporting platform might tolerate several hours, while a customer authentication platform needs downtime kept as short as possible.
RPO measures how much recent data the organisation can afford to lose — ranging from one hour down to near-zero, with lower targets usually requiring more frequent backups or continuous replication.
Designing Backup Infrastructure That Supports Recovery
Dedicated backup servers isolated from production workloads.
Private networking for secure replication between systems.
Enterprise NVMe storage for rapid backup and restore operations.
Off-site backup repositories located separately from production infrastructure.
Automated backup verification and alerting.
Immutable storage policies and a documented disaster recovery plan.
The Human Element Still Matters
Even the most advanced backup platform cannot compensate for poor operational process. Reviewing backup policies after infrastructure changes, testing full restores on a regular schedule, documenting recovery procedures, and auditing administrative access all matter as much as the technology itself. Cyber resilience depends on operational maturity as much as it depends on tools.
Infrastructure Considerations
A resilient backup architecture typically combines dedicated backup servers kept isolated from production, private networking for secure replication, and NVMe dedicated servers for fast backup and restore performance. Businesses wanting a fully isolated off-site copy often pair this with colocation for physically separate hardware, dedicated backup solutions, and a documented disaster recovery plan covering the wider business continuity picture beyond backup alone.
Frequently Asked Questions (FAQ)
Can ransomware infect backups too?
Yes — this is exactly why the 3-2-1 rule requires a genuinely isolated off-site or offline copy. Attackers deliberately target connected backup systems, since backups are the main way victims avoid paying.
Should a business ever pay a ransomware demand?
UK guidance from the National Cyber Security Centre generally advises against paying, since it doesn't guarantee data is restored, funds further criminal activity, and can mark a business as a repeat target. A tested recovery plan lets a business decline with confidence rather than out of principle alone.
How often should backups be tested?
At minimum, quarterly, and ideally on a routine schedule rather than as a one-off event. A backup that has never been restored is a theory, not a proven recovery path.
Is cloud backup automatically air-gapped?
No. If backup credentials are compromised alongside the rest of the network, cloud backups can be deleted or encrypted too, unless immutability or a genuinely separate access path is in place.
Does Cyber Essentials cover backup and ransomware recovery?
Cyber Essentials focuses primarily on baseline technical controls rather than backup strategy specifically, but businesses pursuing certification often find that a properly implemented 3-2-1 or 3-2-1-1-0 strategy supports the wider resilience expectations that certification and client due diligence increasingly require.
