iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Use both. The 3-2-1 rule spreads your data across copies, media and locations; immutable storage prevents an attacker from deleting or overwriting protected recovery points. A ransomware-ready design normally uses a 3-2-1 baseline and extends it to 3-2-1-1: three copies, two media types, one off-site copy and one immutable, isolated copy.
Neither approach is a complete recovery plan by itself. Disconnected media, separate identities, encryption, retention governance and tested restores determine whether backups remain usable after an attack.
What the 3-2-1 backup rule actually requires
The 3-2-1 rule is a redundancy pattern, not a particular product. CISA’s LockBit advisory defines it as three copies of data—one production copy and two backup copies—stored on two different media, with one copy kept off-site for disaster recovery.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Three copies, including production
Count the live production dataset as copy one. Add two independent backup copies. For example, a file server plus a local disk backup plus a cloud backup satisfies the copy count. Three snapshots inside the same storage system do not provide the same protection: a ransomware operator with access to that system may be able to delete or encrypt all of them.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Two different media types
Use materially different storage technologies, such as local disk and removable media, disk and tape, or disk and cloud object storage. The point is to avoid a single technology defect, encryption failure or administrative action affecting every copy.
One copy off-site
Keep at least one backup outside the production site or its failure domain. Off-site can mean a separate facility, region or cloud environment, provided the administrative and network boundaries are also independent enough to resist a shared compromise.
The rule reduces common-mode failure. It does not, by itself, stop an administrator or ransomware process from deleting connected backups, nor does it guarantee that a backup can be restored.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What immutable cloud backup adds
Immutable storage uses retention controls to create a write-once, read-many (WORM) state. During a customer-defined retention period, protected objects or recovery points cannot be permanently deleted or overwritten, including by an accidental or unauthorized operation. AWS describes this as protection against deletes, overwrites and ransomware compromise.
Object-level and vault-level immutability
In Amazon S3, Object Lock blocks permanent deletion of retained object versions and works with bucket versioning. AWS Backup Vault Lock applies analogous retention protection to backup recovery points. In Azure, immutable Blob storage and immutable Recovery Services vaults can prevent deletion or reduction of retention before the expiry time.
Immutability protects what is inside the retention boundary. It does not automatically protect the cloud account, identity provider, encryption keys, metadata, configuration or restore process. An attacker who controls the account may still stop backup jobs, alter destinations, disable monitoring, destroy keys or prevent your team from reaching a valid recovery point. Those controls need separate administrative and technical boundaries.
Durability is not recoverability
Current S3 product documentation states a durability target of 99.999999999% (11 nines) for S3 objects. That is a durability claim for stored objects, not a promise that your retention is immutable, your credentials are safe, your data is available in the required region or your systems can meet a recovery-time objective. A durable, locked object is useful only if the backup is complete, identifiable and restorable.
Why 3-2-1 and immutable storage work better together
Microsoft’s 3-2-1-1 guidance adds one immutable, isolated copy to the traditional rule. The combination addresses different failure modes:
- Copy and media separation: 3-2-1 limits the damage from a failed disk, corrupted backup chain or site disaster.
- Geographic separation: An off-site copy remains available if the production facility is lost or isolated.
- Deletion and overwrite resistance: Immutability preserves selected recovery points even when an attacker reaches backup administration.
- Operational independence: An isolated copy can be restored without depending on the compromised production environment.
For most organizations, the practical target is production data plus a local backup for fast restores, a separate off-site backup and an immutable or offline copy that cannot be changed during its retention window.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
3-2-1 versus immutable cloud backups
| Decision factor | 3-2-1 without immutability | Immutable cloud copy | What a combined design does |
|---|---|---|---|
| Resistance to ransomware deletion | Depends on permissions, network isolation and whether the backup is disconnected. Connected copies may be deleted or encrypted. | Protected objects or recovery points cannot be permanently deleted or overwritten during retention. | Use immutable retention for critical recovery points while keeping other copies on separate media. |
| Compromised backup credentials | Separate accounts and offline media can limit damage, but ordinary cloud copies may still be altered. | Retention protects locked data, but compromised credentials can still disrupt jobs, metadata, keys or access. | Use separate tenants, subscriptions or accounts, least privilege, MFA and approval for destructive changes. |
| Media and regional separation | Explicitly requires two media types and one off-site copy. | Cloud may supply an off-site medium, but a single region or account can remain a shared failure domain. | Place immutable data in an independent account or region and retain a second media type, such as removable media or tape. |
| Restore speed | A local disk copy can provide the fastest restore for large datasets. | Restore speed depends on cloud bandwidth, service limits, data location and egress. | Restore routine files locally and reserve cloud or offline copies for broader or more severe incidents. |
| Scale | Removable media and tape require capacity planning, handling and rotation. | Cloud capacity scales more easily, but large restores can take time and incur transfer charges. | Keep frequently needed data on fast local storage and long-retention recovery points in economical immutable tiers. |
| Operational complexity | Requires media rotation, labeling, transport, encryption and physical custody. | Requires retention-mode configuration, identity design, logging, key management and lifecycle governance. | Automate cloud controls while documenting human procedures for offline copies and emergency restores. |
| Retention and legal holds | Media can often be overwritten or destroyed unless procedures prevent it. | Retention cannot be shortened before expiry; legal holds may extend preservation and delay deletion. | Map retention periods and holds to legal requirements before enabling locked mode. |
| Storage and egress cost | Up-front hardware and handling costs are predictable; replacement and transport add expense. | Storage, requests, retrieval and egress vary with volume, region and restore frequency. | Model normal backup, retention growth and a full-environment restore rather than storage alone. |
| Compliance fit | Can be easier to destroy at the end of a mandated retention period if custody is controlled. | Immutable storage may conflict with rules requiring deletion or correction and can be misconfigured at significant cost. | Obtain legal and compliance approval for retention mode, holds, expiry and documented exceptions. |
| Restore-test effort | Each media type and rotation set must be read and validated. | Tests must verify access, retention, object versions, keys, network paths and cloud recovery procedures. | Test every recovery source and prove that systems can be rebuilt independently of production. |
Build a ransomware-resistant 3-2-1-1 architecture
1. Define the recovery requirements first
Set a recovery point objective (RPO): how much recent data the business can afford to lose. Set a recovery time objective (RTO): how long a service may remain unavailable. Record which data needs file-level, application-level and whole-volume recovery, and how far back point-in-time recovery must reach.
These decisions determine backup frequency, retention length, storage classes, network capacity and the number of recovery points that must be immutable. A daily backup cannot meet a four-hour RPO, and an immutable copy that takes two days to download cannot meet a four-hour RTO without a faster recovery source.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →2. Create the three copies
- Production: Identify authoritative systems and data owners. Include databases, virtual machines, cloud services, configuration, certificates and other information needed to rebuild the service.
- Local backup: Write to a separate backup system or disk pool for quick operational restores. Keep it on a different administrative boundary from production where possible.
- Off-site backup: Send a second backup to another facility, region or cloud account. Verify that a site outage or network isolation at production does not remove access to this copy.
3. Use two genuinely different media types
A local disk plus cloud object storage, or disk plus removable media, is a common pattern. Two logical volumes on the same array are not meaningful media diversity if one controller, firmware defect or administrator can affect both.
4. Add an immutable, isolated recovery point
Choose the recovery points that must survive an administrative compromise and place them under a retention policy that cannot be shortened before expiry. Isolate the copy with a separate account, subscription or vault, restricted network paths and distinct privileged identities. Record who can change retention, who can restore and who can approve emergency access.
5. Protect the control plane
- Use separate backup administrator accounts rather than reusing production domain-admin credentials.
- Require phishing-resistant MFA where supported and use out-of-band approval for retention, vault, key or destination changes.
- Apply least privilege: backup operators should not automatically be able to delete immutable data or alter encryption keys.
- Send backup, identity and storage audit logs to a monitoring system outside the protected account.
- Alert on disabled jobs, unusual deletion attempts, retention changes, key access failures and large restore requests.
How to maintain a safe offline copy
An offline copy is disconnected or otherwise isolated so that ransomware cannot reach it through the production network. CISA specifically warns: “Avoid leaving the external drive connected when not actively backing up your data as the connection could be used by ransomware to gain access to the drive and delete or corrupt your backups.”
Offline-drive procedure
- Prepare at least two encrypted removable drives or other removable media so one can be stored while the other is in use.
- Connect the designated drive only during the controlled backup window. Use a dedicated backup workstation or account that is not used for everyday browsing or email.
- Run the backup and confirm that the job completed, the expected datasets are present and the media has enough free capacity.
- Verify reads by opening representative files and performing an integrity check supported by your backup software.
- Record the media identifier, backup date, retention end date and encryption-key location without storing the key on the same drive.
- Safely eject and physically disconnect the drive. Store it in a protected location separate from the production site; rotate the next drive into the schedule.
- Periodically restore from each rotated drive, not just the newest one, and replace media that shows read errors or degraded performance.
One external hard drive is only one backup layer. It does not satisfy 3-2-1 by itself, and it is vulnerable while connected, lost, damaged or encrypted with an unavailable key. Encryption protects confidentiality; it does not replace rotation, off-site storage or restore testing.
Implementing immutable cloud retention
Amazon S3 Object Lock
S3 Object Lock uses versioning and a WORM retention model. Configure a retention mode and period appropriate to the data, then confirm that ordinary operators cannot shorten or bypass it. Test both object creation and attempted deletion from a non-privileged account before relying on the configuration.
Choose retention long enough to cover the time in which an intrusion might remain undetected, plus the investigation and recovery period. Longer retention increases storage usage and can make legitimate deletion impossible until the clock expires, so document the business and legal rationale.
AWS Backup Vault Lock
Vault Lock applies retention protection to backup recovery points rather than individual object files. Confirm which resources are covered, how recovery points are indexed, who can initiate a restore and how an emergency restore works if production credentials are unavailable.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Azure immutable storage
Azure Blob immutable storage and immutable Recovery Services vaults can prevent deletion or retention reduction before the configured expiry. Use an independent subscription or account where feasible, restrict management-plane permissions and verify that backup data, encryption keys and recovery tooling remain available during a production-account compromise.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRetention, legal hold and expiry governance
Immutable policies can conflict with privacy, contractual or regulatory requirements that require deletion or correction. CISA cautions that immutable cloud storage may fail some compliance criteria and that misconfiguration can create significant cost. Before locking data, document:
- the required retention period and the event that starts the clock;
- which records require a legal hold and who may release it;
- how expired data is deleted and how deletion is evidenced;
- what happens when a key, account or region is unavailable;
- how storage growth, retrieval and egress will be funded.
Recovery testing: prove that the design works
CISA calls for regular testing of backup availability and integrity. Microsoft also recommends independent recovery data and regular tests. A successful backup job is not proof of a successful restore.
Define test cases
- File restore: Recover individual files, permissions and versions from the local copy.
- Application restore: Rebuild a database or business application with its configuration, dependencies and credentials.
- Volume or system restore: Recover an entire server or virtual machine, including boot and network settings.
- Point-in-time restore: Select a recovery point before simulated encryption and verify that the data is usable.
- Account-loss scenario: Restore from the isolated copy using a break-glass identity rather than production administrator credentials.
Use an independent sandbox
- Provision a clean test environment that is separated from production networking and identity.
- Retrieve a specified recovery point from each media type, including the immutable and offline copies.
- Restore the operating system, application data, configuration and required secrets in the documented order.
- Validate file contents, database consistency, application behavior, permissions and timestamps with the business owner.
- Measure elapsed time against the RTO and calculate data loss against the RPO.
- Record failures, missing dependencies, key-access problems, bandwidth limits and operator decisions; assign owners and retest after correction.
Test after major changes to backup software, cloud accounts, encryption keys, network architecture or retention policy. Keep the runbook and emergency contacts available outside the production environment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Cost, scale and operational trade-offs
3-2-1 has visible hardware, media rotation, custody and replacement costs. Local disk reduces restore time but requires capacity planning and protection against site loss. Removable media can be inexpensive per terabyte and genuinely offline, but staff must label, rotate, transport and periodically read it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Immutable cloud storage shifts more work to configuration and governance. Storage grows with retention, and retrieval, API requests and egress can add charges during a large incident. A design that is affordable for daily incremental backups may be expensive when a full environment must be downloaded quickly. Model at least three cases: normal monthly operation, retention growth over the policy period and a full disaster recovery event.
Cloud scale is useful for many recovery points and geographically separate copies, while local disk is usually better for frequent small restores. Keeping both avoids using a slow or expensive emergency path for routine user mistakes.
Common failure modes and fixes
All copies are connected to the same identity
Symptom: One compromised administrator can delete production, local backups and cloud copies. Fix: Separate accounts or subscriptions, least privilege, MFA, independent logging and approval for destructive changes.
The “offline” drive stays plugged in
Symptom: Ransomware encrypts or deletes the removable backup. Fix: Disconnect outside controlled backup windows, rotate multiple encrypted drives and verify reads after each cycle.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Immutable retention is configured in the wrong scope
Symptom: Some recovery points are unprotected, or retention cannot be shortened when policy requires deletion. Fix: Map resources and retention classes before locking, test with a non-privileged account and obtain compliance approval.
Only backup-job success is monitored
Symptom: Jobs report success but files, keys or application dependencies cannot be restored. Fix: Schedule sandbox restores, validate data with owners and alert on integrity, access and key failures.
The cloud copy shares the production failure domain
Symptom: A stolen identity or unavailable region blocks both production and backup. Fix: Use an independent account, subscription or region, separate administrative credentials and a second media type.
Retention ignores the attacker’s dwell time
Symptom: Every retained recovery point contains encrypted or tampered data because the compromise was discovered late. Fix: Keep historical points long enough to precede likely detection and preserve selected points under immutable retention.
Which approach should you choose?
Small office or home lab
Start with production data, a local backup and an encrypted removable drive that is disconnected and stored elsewhere. Add a cloud copy when the data cannot be recreated or the site is vulnerable to fire, theft or flooding. Test a file restore before assuming the arrangement works.
Small and midsize business
Use local disk for fast restores, an off-site cloud or facility copy and an immutable retention tier for critical systems. Separate backup administration from the production directory, require MFA and schedule application-level recovery tests.
Regulated or high-availability organization
Adopt a documented 3-2-1-1 architecture with independent accounts or subscriptions, immutable vault or object retention, an offline or otherwise isolated copy, formal legal-hold handling and measured RPO/RTO tests. Involve legal and compliance teams before enabling retention that cannot be shortened.
Bottom line
3-2-1 answers the question “Where are my independent copies?” Immutable storage answers “Can an attacker delete or overwrite the recovery points?” The safest ransomware strategy uses both, adds disconnected media where practical, separates identities and regions, and proves recovery through regular independent tests. Treat cloud durability as storage resilience—not as evidence that your retention, access controls or recovery process are ransomware-safe.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
