A backup plan that survives ransomware

By the FarSec team · Updated 2026-11-12

Why backups fail when they are needed

Most companies we speak to say "we have backups". When something goes wrong, the same few problems keep showing up:

• The backup sits on the same network. A shared drive or USB disk that is always plugged in gets encrypted together with everything else.
• Nobody checks it. The job stopped months ago because a disk filled up or a password changed, and no one noticed.
• The important data is not in it. Accounting software databases, the scanner folder, staff laptops and WhatsApp business chats are often missed.
• The restore takes days. The files are there, but no one knows the order to rebuild systems, or the internet line is too slow to download everything.
• Cloud sync is mistaken for backup. If a file is deleted or encrypted on a laptop, sync tools copy that damage to the cloud too.

The 3-2-1 rule in plain words

1. 3 copies: the live data plus two backups.
2. 2 kinds of storage: for example a small network storage box (NAS) in the office and a cloud backup service, or a NAS and rotated external disks.
3. 1 copy off-site and offline: a disk that is unplugged and taken home or to a second branch, or a cloud backup with immutability / version lock so it cannot be deleted for a set number of days, even by an admin password.

The offline or locked copy is the part that saves you from ransomware. Everything else protects you from disk failure and mistakes.

What to back up

• Accounting and ERP data (database files and their own backup exports, not only the program folder).
• Shared drives and the folders where scanners and machines save files.
• Email, if it is hosted on your own server or cPanel; Microsoft 365 and Google Workspace also need a separate backup for deleted mail and files.
• Laptops of directors, accounts and sales staff, where most real work lives.
• Website files and database, plus DNS records and the hosting login details stored safely.
• Configuration: firewall and router settings, licence keys, and a short document on how each system is set up.

How often

Ask one question for each system: how much work can we afford to redo? For accounts and ERP, that is usually one day or less, so back up at least daily. For shared files, daily with several versions kept. For servers and settings, weekly plus after every change. Keep daily versions for at least two weeks and monthly versions for a year, because ransomware and mistakes are often noticed late.

A low-cost setup for a small office

• A 2-bay NAS with mirrored disks as the first backup target, on its own admin account that staff do not use.
• Automatic cloud backup from the NAS with version history and a deletion lock turned on.
• Two external disks rotated weekly: one connected for the backup, one kept unplugged at another location.
• Backup software alerts sent to two people, so a failed job is seen the same day.
• Encryption on disks that leave the office, with the key stored somewhere safe (not on the same disk).

Protect the backup itself

• Use a separate password and multi-factor authentication for the backup system and cloud account.
• Do not join the backup server to the normal office domain or give everyday admin accounts access to it.
• Turn off file sharing on the backup target except for the backup software.
• Watch for sudden changes: a backup that is much larger or smaller than usual can be the first sign of ransomware.

Test restores, not just backups

1. Every week: check that last night's jobs finished and open one random file.
2. Every quarter: restore one full system (for example the accounting database) to a spare machine and confirm it works. Time how long it takes.
3. Every year: walk through a "whole office is down" day on paper: what comes back first, who does it, and how long the internet download would take.

Write the restore steps on one page and keep a printed copy. During an incident, the shared drive with the instructions may be the thing that is encrypted.

Backups are the last line of defence. They work best together with the basics in our ransomware protection guide and the small business checklist, and with staff phishing training, since most attacks start with one email.

Free check for Pakistani businesses

Send your domain to [email protected] and we will reply with a free one-page check of your email protection (SPF, DKIM, DMARC) and website basics. We use public information only; nothing is tested without your written permission. If you would like help designing or testing your backup and restore plan, ask in the same email.