Cloud
Cloud Storage and Backups: The 3-2-1 Rule for Normal People
Everyone believes they have backups until the day they need one. Usually what they have is sync, which faithfully replicates a deletion or an encryption event to every device within seconds. The distinction is the whole subject. This is a practical backup design that ordinary households and small teams can actually maintain, built on a rule that has survived every change in storage technology for thirty years.
Sync is not backup
A sync service exists to make every copy identical. If a file is deleted, corrupted or encrypted on one device, that state is the truth and it propagates. Identical copies are not independent copies.
A backup exists to preserve a previous state. It must be able to answer the question: what did this folder look like last Tuesday? If your system cannot answer that, it is not a backup regardless of how much cloud storage you pay for.
Most sync services do keep version history and a trash for a limited window, which helps. Windows are typically thirty days, which is shorter than the time it usually takes to notice a quiet corruption.
The 3-2-1 rule, restated
Three copies, two media, one offsite
Keep three copies of anything you cannot recreate. Store them on at least two different kinds of media or services, so a single product failure cannot take all of them. Keep at least one copy physically elsewhere, so a fire, flood or theft is survivable.
The modern addition is a fourth condition: one copy should be offline or immutable, meaning ransomware running on your machine cannot reach and rewrite it. A cloud bucket with versioning and delete protection satisfies this, as does an external drive that is unplugged between backups.
For most households this looks like: the working copy on your device, a cloud service with version history, and an external drive updated monthly and kept at a relative's house or in a drawer at work.
- Three copies of irreplaceable data
- Two different storage types or providers
- One copy stored somewhere else physically
- One copy offline or write-protected
What is actually irreplaceable
Be honest about scope. Installed applications, downloaded media and operating system files are all re-obtainable and do not need backing up. Photos, documents you wrote, financial records, project files, key exports and years of messages are not.
Write the list once. It is usually smaller than people expect, often under a few hundred gigabytes, which makes a proper backup far cheaper than the vague sense of a giant task suggests.
Include the things that live only inside apps: authenticator seeds, password manager exports, note apps, and phone messages. These are the items people discover missing after a restore.
Ransomware changes the design
Ransomware encrypts everything it can write to, including mapped network drives and mounted cloud folders. A backup that is permanently mounted is a backup that gets encrypted alongside the original.
Versioning saves you here, provided the retention window is long enough and the attacker cannot delete versions. Choose services that support object versioning and a delete hold, and set retention to at least ninety days.
An unplugged external drive is crude and extremely effective. Software cannot encrypt a disk that is not connected.
Test the restore, not the backup
The step everyone skips
A backup job reporting success proves data was written. It does not prove data can be read back, that the archive is not corrupt, or that you remember the encryption passphrase.
Twice a year, restore a handful of real files to a new location and open them. Once a year, do a larger restore. Note how long it takes; recovery time is part of the plan, and discovering that a full restore takes four days is better learned in advance.
Store recovery credentials outside the system being backed up. A password to your backup service that lives only in a file on the failed machine is not a password you have.
A setup you will maintain
Automate the cloud layer so it needs no attention. Keep the offline layer manual but scheduled, tied to a calendar reminder on a fixed date each month so it does not depend on remembering.
The best backup system is the boring one that has been running unchanged for two years. Complexity is the enemy of maintenance, and an unmaintained backup is indistinguishable from no backup at the moment it matters.
