Variations on the 3-2-1 rule for backup

For BBQ aficionados, the “3-2-1 method” is about how to make proper low-and-slow Texas-style BBQ ribs. Smoke the ribs for three hours, then wrap them in butcher’s paper and smoke for two hours more, then unwrap and smoke for one more hour. 

But is it really a strict rule? Not at all. Depending on how you and your guests like your ribs, you may very well decide to change things up. Do you like them falling off the bone? Maybe you’ll let them cook an extra hour. Prefer them a little on the dry side? Maybe don’t wrap them. As long as you know what you want to achieve, you are welcome to vary the rule. 

The rule for data backup

In the world of IT, the 3-2-1 rule refers to a set of best practices for secure data backup. It was first described and popularized by professional photographer Peter Krogh, in his 2005 book The DAM Book: Digital Asset Management for Photographers.

Since then, the 3-2-1 rule has been widely adopted as a standard, and incorporated into certain regulations. For example, there are American states that require school districts to implement the rule in order to be eligible for certain types of funding support.

So, what is the rule?

• Maintain at least three copies of your data (including the original and two backups). 
  This step dramatically reduces the chance of all copies of your data being deleted or corrupted, especially when observing the other two steps.

• Use at least two different storage media types. 
  In case of unexpected incidents that may affect a particular type of storage, this step ensures that at least one copy survives.

• Keep at least one copy off-site, in a separate geographic location or in the cloud. 
  This protects your data against localized disasters such as flood, fire, or theft.

Variations on the rule gaining currency

So, the 3-2-1 rule definitely makes your data more secure against a wide variety of misadventures. But as types of media have proliferated, and as cyber threats—primarily ransomware—have become more sophisticated (often beginning their attacks by trying to find and destroy backup files), variations of the rule have begun to circulate.

3-2-1-1-0

This variant on the rule adds an extra “1” to represent the need for an air-gapped and/or immutable copy. An immutable backup is one that cannot be altered or deleted. An air-gapped backup is one for which there is no digital access route. Both immutable and air-gapped backup copies provide very strong protection against sophisticated ransomware attacks.

The extra “0” represents zero tolerance for errors. It’s meant as a reminder to conduct frequent testing and verification of backup systems. By doing so, it recognizes that for many organizations, backup systems are a low priority for management, administration, and ongoing investment. 

That’s an understandable attitude. But if ransomware destroys mission-critical data and you then find that your backup hasn’t been working as well as you assumed, well … you’re going to feel sad about that.

4-3-2

This variant simply bumps everything up by one: Keep four copies of your data, use three different types of storage, and keep two copies off-site, separately.

The main point of this variant is to take advantage of the increasing variety of data storage media and cloud environments. It definitely increases the security of your data. But we can easily project that as the variety of storage choices continues to grow, this approach might soon reach a point of diminishing returns. 12-11-10, anyone? Yeah, probably not worth it.

Backup to meet your specific needs

I like my ribs moist, smokey, and fall-off-the-bone tender—without a lot of sauce all over them. So, I’ve developed a 4-3-2 process at very low heat that includes a long middle period with the ribs wrapped in butcher paper with a mix of beer and orange juice. 

Similarly, you need to evaluate your organization’s backup needs and choose a system that best addresses them. What are your objectives for recovery time (RTO) and recovery point (RPO)? A faster recovery time will quickly get you back up and running after an incident. And the greatest flexibility in designating a recovery point will keep your net data loss to a minimum if the worst should happen. 

Think about scalability too. How fast is your store of data growing? Your system should also be compatible with all parts of your existing IT infrastructure. 

The most important thing is to take backup seriously and make it a core part of your IT processes. Keeping up with advanced backup technologies and strategies is just as important as investing in modern email or network protection—if not more so.

If you’ve been relying on an older system, without testing it or adding redundancy, you definitely need to look into the wide variety of modern systems that are available.

And be sure to consider Barracuda’s data protection offerings. Whether you prefer on-site or virtual appliances, cloud-based systems, or a combination, these solutions will ensure ongoing peace of mind, minimal IT overhead, and fast, reliable data recovery when you need it.