For Users
Community answers, written up as guides

How to Create a Secure Backup with the 3-2-1 Rule

how to create a secure backup

By 2 min read
How to Create a Secure Backup with the 3-2-1 Rule

To create a secure backup, follow the 3-2-1 rule: keep three copies of your data on two different storage types with one copy stored offsite. This gives you redundancy and protection against hardware failure, theft, or disaster.

Encrypt your data before backing it up, especially for cloud or offsite copies. Users recommend KeePassXC for sensitive files and Veracrypt for encrypting entire drives. Testing restore is essential: verify your backups work by restoring to a temporary folder or virtual machine.

Use local storage like external drives or NAS devices alongside cloud services such as Backblaze B2, S3, DigitalOcean, R2, or Wasabi. Keep an offline copy to protect against ransomware. Automation reduces human error and ensures consistency.

Best practices

  1. Follow the 3-2-1 rule Three copies, two storage types, one offsite
  2. Encrypt everything Use KeePassXC for files or Veracrypt for full drives
  3. Test restores regularly Verify backups in a temp folder or virtual machine
  4. Automate the process Reduces human error and ensures consistency
  5. Keep an offline copy Protects against ransomware and online threats
  6. Use versioning Keeps historical copies so you can revert if needed
  7. Segregate your data Separate critical data from disposable OS files
How to Create a Secure Backup with the 3-2-1 Rule — infographic

General Best Practices

Encrypt everything: Always encrypt your data before backing it up, especially for cloud storage or offsite copies, to protect against unauthorized access. Users suggest using tools like KeePassXC for sensitive files or encrypting entire drives with Veracrypt. "You can encrypt them by default, for example, using KeePassXC. Then making a copy of such sensitive data will be very easy."
Test your backups: Regularly verify that your backups can be restored successfully to ensure data integrity and usability when needed. "The biggest thing people skip is testing restore. spin up a temp folder or throwaway vm, restore one service into it, and make sure it actually boots with the data."
Automate when possible: Use tools and scripts to automate your backup process, reducing the chance of human error and ensuring consistency. "A lot of tools look great until you actually need to rebuild something under stress."

Backup Mediums

Local storage: Use external hard drives or a Network Attached Storage (NAS) device for convenient local backups. "NAS at home, Backblaze B2 for a remote, downloadable copy."
Cloud storage: Utilize cloud services for offsite storage, which protects against local disasters. "Use S3, DigitalOcean, R2 or Wasabi storage for keeping save your files."
Offline storage: Keep an offline copy, such as a disconnected external drive, to protect against ransomware and other online threats. "The only backup safe from ransomware is an offline one."

Advanced Strategies

Version control: Implement versioning to keep multiple historical copies of files, allowing you to revert to older states if a recent backup is corrupted or unwanted changes occur. "Three copies at 10-day intervals, gets replaced in cyclic order."
Segregate data: Separate critical data from disposable operating system or application files to streamline backups and restores. "The OS partition is disposable. Meaning all important data needs to be in the DATA partition."
Shamir's Secret Sharing: For extreme security, consider splitting master passphrases into multiple shares, distributed among trusted individuals, to recover data even in extreme personal loss scenarios. "A master passphrase split into a 2-of-3 Shamir's Secret Sharing (SSS) scheme, stamped onto 3 fireproof stainless-steel plates."

Are you interested in specific software recommendations for secure backups?

Bottom line

To create a secure backup, implement the 3-2-1 rule: maintain three copies of your data, using two different types of storage, with one copy stored offsite. This strategy balances data redundancy, accessibility, and protection against various threats like hardware failure, theft, or disaster.

FAQ

What is the 3-2-1 backup rule?
The 3-2-1 rule means keeping three copies of your data on two different types of storage with one copy stored offsite. This balances redundancy, accessibility, and protection against various threats.
How do I encrypt my backups?
Use tools like KeePassXC for sensitive individual files or Veracrypt to encrypt entire drives. Always encrypt before backing up, especially for cloud storage or offsite copies, to prevent unauthorized access.
How do I protect my backups from ransomware?
Keep at least one offline backup, such as a disconnected external drive. Users note that the only backup safe from ransomware is an offline one, since connected drives can be encrypted by malicious software.
What storage options work best for backups?
Local options include external hard drives and NAS devices. For offsite cloud storage, users suggest S3, DigitalOcean, R2, Wasabi, and Backblaze B2. Combining local and cloud storage gives you both convenience and disaster protection.
How often should I test my backups?
Test backups regularly to confirm they restore successfully. Users recommend spinning up a temporary folder or throwaway virtual machine, restoring one service into it, and verifying it boots with the data.
What is Shamir's Secret Sharing for backups?
Shamir's Secret Sharing splits a master passphrase into multiple shares distributed among trusted individuals. For example, a 2-of-3 scheme stamped onto fireproof stainless-steel plates lets you recover data even in extreme scenarios.

Comments (0)

No comments yet. Start the conversation.