ไทย
English
Having a Backup is an essential part of data protection, especially as threats such as Ransomware not only target data in active use but may also attempt to access, delete, or encrypt Backup data to prevent organizations from recovering their systems after an incident.
Building on the fundamental 3-2-1 Backup Rule discussed in our previous article, the 3-2-1-1-0 Backup Strategy introduces additional protection for Backup data while emphasizing an aspect that is just as important as performing Backups: the ability to successfully restore data when needed.
Table of Contents
What Is the 3-2-1-1-0 Backup Strategy?
The 3-2-1-1-0 Backup Strategy is an approach developed by Veeam as an extension of the 3-2-1 Backup Rule. It introduces the requirement to maintain at least one Backup copy that is Offline, Air-gapped, or Immutable, along with verification to ensure that Backup data can be successfully recovered without errors. This approach consists of the following principles:
3 – Maintain at Least 3 Copies of Data
This includes one copy of the original data in active use and at least two additional Backup copies, ensuring that Recovery does not depend on a single Backup copy.
2 – Store Data on at Least 2 Types of Storage Media or Systems
Distributing Backups across different storage systems helps reduce the risk of data loss or disruption caused by failures affecting a particular type of Storage.
For example, Production Data may reside on Production Storage, while another Backup copy is stored on a Backup Appliance, Object Storage, or Cloud Backup.
1 – Keep at Least 1 Backup Copy Offsite
Offsite Backup helps reduce risks when the primary office or Data Center is affected by incidents such as fire, flooding, power outages, or Infrastructure failures.
1 – Maintain at Least 1 Offline or Immutable Backup Copy
This Backup copy should be isolated or protected against unauthorized modification or deletion from the primary environment. This helps reduce risks if attackers gain access to the systems or accounts used to manage Backups.
0 – Verify That Backups Are Ready for Recovery
The number 0 emphasizes Backup verification and Recovery validation to ensure there are no undetected errors and that the backed up data can be successfully restored and used when needed.
From 3-2-1 to 3-2-1-1-0: Why Is Additional Backup Protection Necessary?
The 3-2-1 Backup Rule remains a solid foundation for designing a Backup system because it distributes data across different storage systems and locations rather than relying on a single point. However, today’s evolving cyber threats require organizations to consider another important question: What happens if an attacker gains access to both the Backup environment and Production systems?
For example, if a Production Server and Backup Repository are connected to the same Network and share accounts with access privileges, an attacker who compromises those credentials may gain access to both the original data and its Backup copies.
In this scenario, even if an organization maintains multiple Backup copies, its Recovery capabilities may still be compromised if all copies can be modified or deleted through the same system. This is why the 3-2-1-1-0 approach introduces Offline or Immutable Backup as an additional layer of protection.
What Is the Difference Between Offline Backup and Immutable Backup?
Offline Backup refers to Backup data that is disconnected from the system or Network when not in use, preventing the primary environment from continuously accessing that Backup copy.
Immutable Backup, on the other hand, refers to Backup data that is protected from modification or deletion for a specified period, even if certain users or accounts have access to the Storage system.
Organizations can implement either approach individually or combine both, depending on their Infrastructure, data criticality, retention requirements, and Recovery processes.
The key consideration is to ensure that at least one Backup copy has protective measures in place to reduce the likelihood of a single incident compromising both Production and Backup environments simultaneously.
How Does Immutable Backup Help Protect Against Ransomware?
One of the risks organizations should consider is Ransomware that attempts to locate Backup data after gaining access to an environment. If Backups can be deleted or modified using the same administrative accounts as other Infrastructure systems, attackers who obtain those privileges may attempt to delete Backup data before encrypting Production Data. Immutable Backup helps mitigate this risk by enforcing a defined period during which Backup data cannot be modified or deleted.
For example, if an organization configures an appropriate Retention period to protect its Backups, it may still have a Recovery Point available for system restoration even if Production Data is compromised.
However, Immutable Backup should be implemented as part of an overall Security, Backup, and Disaster Recovery strategy rather than being considered solely as a measure against Ransomware.
Why Is the Number 0 Important?
One common mistake in Backup Management is checking only whether a Backup Job displays a Successful status.
In practice, other issues may still exist. For example, Backup Files may be incomplete, certain databases may not have been backed up, necessary Configuration files may be missing, or files may be successfully restored while the Application itself remains unable to operate. Therefore, the purpose of the number 0 should also include verifying that Backups are genuinely ready for Recovery.
Organizations should regularly monitor Backup status and perform Restore Testing at the file, database, or system level, depending on the importance of each Workload.
For business critical systems, Recovery Testing should be conducted according to a defined plan to verify that the team can restore systems to operational status within the timeframe required by the business.
Example of Implementing the 3-2-1-1-0 Backup Strategy
Suppose an organization operates critical Applications and databases on Servers or Virtual Machines within its Data Center. A Backup system designed according to the 3-2-1-1-0 principle could be structured as follows:
3 – Maintain at Least 3 Copies of Data
This includes one copy of active Production Data and at least two additional Backup copies, ensuring that the organization does not depend on a single copy of data when a disruption occurs.
2 – Store Data on at Least 2 Types of Storage or Media
Backups should not all be stored on the same type of Storage system. For example, Production Data may reside on Primary Storage, while another Backup copy may be stored on Backup Storage, Object Storage, Tape, or Cloud Storage. This helps reduce the risk of data loss caused by failures affecting a particular type of Storage.
1 – Keep at Least 1 Backup Copy Offsite
Another Backup copy should be transferred to a location separate from the primary environment, such as Cloud Backup or a Secondary Data Center. This ensures that data can still be recovered if the primary Data Center is affected by fire, flooding, power outages, or other incidents that disrupt the entire Site.
1 – Maintain at Least 1 Offline, Air-gapped, or Immutable Backup Copy
This Backup copy should be designed to prevent easy modification or deletion from the Production environment. Examples include Immutable Backup, Object Lock, Air-gap, or Offline Media, which help protect Backup data if attackers or Ransomware gain access to the Backup environment.
0 – Ensure There Are No Undetected Backup Errors
Simply having Backup Files is not enough. Organizations should regularly perform Monitoring, Backup Verification, and Restore Testing to confirm that Backups are completed successfully, contain no undetected errors, and can be used for actual Recovery when an incident occurs.
When all components of the 3-2-1-1-0 strategy work together, organizations not only maintain multiple Backup copies but also reduce risks associated with Storage, Location, and data access privileges. This approach also increases confidence that existing Backups can be used to successfully recover systems, particularly when facing Ransomware or incidents that significantly impact the primary environment.
What Is the Difference Between 3-2-1 and 3-2-1-1-0?
The 3-2-1 Backup Rule focuses on distributing data copies to prevent all data from being stored on a single system or at a single location.
The 3-2-1-1-0 approach extends this concept by introducing additional Cyber Resilience considerations and raising two important questions:
- Can Backup data be deleted or encrypted at the same time as Production Data?
- If an incident occurs, can the organization be confident that its existing Backups can be successfully restored and used?
Therefore, organizations that operate critical systems, rely on continuous data availability, or face Cyberattack risks should consider adopting the 3-2-1-1-0 approach to strengthen their existing Backup Strategy.
What Should Organizations Check Before Implementing 3-2-1-1-0?
Implementing the 3-2-1-1-0 principle should begin with an assessment of the existing Backup environment. Organizations should verify whether critical data has more than one Backup copy, whether all Backups are managed under the same systems or accounts, whether an Offsite Backup exists, whether any Backup copies are Offline or Immutable, and when the organization last completed a successful Restore Test.
If the answers to these questions remain unclear, those areas may represent gaps that should be considered when improving the organization’s Backup Strategy.
Which Organizations Should Prioritize the 3-2-1-1-0 Backup Strategy?
Although the 3-2-1-1-0 principle can be applied to organizations across different industries, certain organizations should place greater emphasis on this approach, particularly those where data loss or service disruption could have significant business consequences.
Examples include:
- Organizations with critical systems that cannot tolerate extended downtime, such as Financial Services, E-commerce, Online Services, or businesses providing continuous customer services. If both primary systems and Backups are affected simultaneously, the organization may be unable to restore services within its defined Recovery Time Objective (RTO).
- Manufacturing companies and organizations operating OT or Production Systems, where system downtime can affect not only data availability but also production lines, revenue, and business operations. Maintaining Backups isolated from primary systems and conducting Recovery Testing are therefore particularly important.
- Hospitals and Healthcare organizationsthat depend on patient data and information systems to deliver services. If critical data or systems become unavailable, the impact may extend to both daily operations and service continuity.
- Organizations that store critical business information or large volumes of customer data, such as Personal Data, Financial Information, Business Documents, or Customer Databases. Data loss may result in operational disruption, reputational damage, and challenges related to data protection requirements.
- Organizations that have experienced or face a high risk of Ransomware and Cyberattacks, particularly those where Production and Backup environments remain within the same Network, Account, or Administrative Domain. If attackers gain elevated privileges, Backup systems may become another target of the attack.
However, the key consideration is how long the business can tolerate downtime if both Production and Backup systems become unavailable simultaneously, and how significant the resulting impact would be.
If systems must be restored within a limited timeframe, data cannot be easily recreated, or Downtime directly affects revenue, customers, or business operations, upgrading from a conventional Backup approach to the 3-2-1-1-0 strategy should be considered as part of Business Continuity and Cyber Resilience planning.
Key Takeaways
The 3-2-1-1-0 Backup Strategy builds on the 3-2-1 Backup Rule to help organizations go beyond simply maintaining multiple copies of data. It introduces additional protection against Backup modification or deletion while emphasizing the importance of verifying that data can be successfully recovered and restored when needed.
The key principles include maintaining 3 copies of data, storing them on at least 2 types of storage systems, keeping 1 copy Offsite, maintaining another 1 copy as Offline or Immutable, and performing Backup and Recovery verification to minimize errors that could lead to Recovery failures.
Strengthen Your Backup Strategy and Recovery Readiness with BMSP Solutions
Designing a Backup system based on the 3-2-1-1-0 principle requires consideration of several interconnected factors, including data types, Backup Architecture, Retention, Immutable Storage, Offsite Backup, as well as the Recovery Point Objective (RPO) and Recovery Time Objective (RTO) of each system.
BMSP provides enterprise Backup and Disaster Recovery solutions to help organizations assess their existing Backup environments, develop appropriate data protection strategies, and design Recovery processes aligned with their Infrastructure and business requirements.
If your organization wants to evaluate whether its existing Backup environment can withstand incidents such as Ransomware and recover critical data within defined objectives, contact BMSP for consultation and guidance on developing a Backup and Disaster Recovery strategy tailored to your organization’s needs.
