Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
A ransomware-resistant backup strategy keeps at least one clean, recoverable copy beyond the reach of compromised production systems and accounts. Build it around multiple separated copies, encryption, tightly controlled backup administration, and regular restore tests; use offline storage or carefully configured immutable storage to protect copies from deletion or overwrite. Neither the 3-2-1 rule nor a cloud backup product alone guarantees recovery: you also need a tested plan to rebuild systems and restore data without bringing malware back.
What makes a backup strategy resistant to ransomware?
A backup helps only if attackers cannot destroy every usable copy and your organization can restore it. Ransomware can encrypt production data, but accessible backups may also be found, deleted, or encrypted by attackers who gain access to the accounts, network, or management tools used to administer them. A strategy should therefore protect both the data and the ability to recover it.
As an Amazon Associate I earn from qualifying purchases.
The joint #StopRansomware Guide from CISA, MS-ISAC, NSA, and the FBI, revised October 19, 2023, recommends maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity in a disaster recovery scenario. In practical terms, that means designing for a situation in which ordinary production credentials and connected infrastructure have been compromised—not merely checking that a backup job says “successful.”
- Keep multiple copies. A single backup location can fail, be corrupted, or become inaccessible.
- Separate at least one copy. Make at least one copy offline or strongly isolated from routine production access.
- Encrypt backup data. Protect it both in storage and during transfer, and safeguard the keys separately from the systems being backed up.
- Restrict administrative access. Do not let routine production accounts automatically control backup deletion, retention, or recovery.
- Prove recoverability. Practice restoring representative data and systems, and track how long the work takes.
These controls address different failure paths. Redundancy gives you alternatives; separation can keep compromised production access from reaching every copy; encryption protects confidentiality; and restore exercises expose problems before an emergency. None substitutes for the others.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
What is the difference between offline and immutable backups?
An offline backup is disconnected from the systems an attacker could use to reach it. An immutable backup is configured so that stored data cannot be changed or deleted during a defined protection period, even by an account with ordinary administrative access. Both can reduce ransomware risk, but they create different boundaries and operational trade-offs.
| Approach | What blocks or limits an attacker | What can go wrong | Useful considerations |
|---|---|---|---|
| Offline copy | Physical disconnection or another strong separation from production and its credentials. | People may forget to disconnect a drive, mishandle it, or discover too late that the restore process is slow or incomplete. | Plan who connects and disconnects media, where it is stored, how it is protected, and how it will be restored at scale. |
| Immutable storage or object lock | Retention settings prevent protected data from being overwritten or deleted for the configured period. | Incorrect settings can leave data exposed, lock data longer than intended, conflict with compliance requirements, or create substantial storage costs. | Review the locking mode and retention behavior, access controls, legal requirements, and projected costs before enabling it. |
| Versioning | Earlier object versions may remain available after a later version is written. | Versioning does not by itself ensure that older versions cannot be deleted or that a clean version is easy to identify. | Pair it with suitable access controls, retention rules, and a tested procedure for finding and restoring an earlier clean version. |
Offline storage creates a clear access boundary, but it requires deliberate handling and a restore plan. Cloud immutability can protect copies without requiring a separate physical environment, but its protection depends on correct configuration and governance. They are not interchangeable labels for “safe backup,” and neither is universally superior. An organization can use both if its recovery needs and operating capacity justify the added complexity.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteConnected drives and cloud synchronization deserve particular care. CISA’s consumer guidance recommends disconnecting an external drive when it is not actively backing up. The joint ransomware guide also warns that synchronized encryption can overwrite cloud files that were previously unaffected. Sync keeps copies aligned; it should not be mistaken for a protected historical backup.
How do I build a ransomware-resistant backup strategy?
Start with recovery priorities, then design the copies, access controls, retention, and restoration process around them. The sequence below works for organizations of different sizes, but the systems, controls, and testing effort should match the impact of losing each service.
1. Identify what must be recovered first
Inventory critical data, systems, and the dependencies required to make them work. Include the business services those systems support, not just the files or servers that are easiest to back up. Identify which services must return first, what must be restored before each can operate, and who is responsible for deciding priorities during an incident.
Use that inventory to set recovery priorities and targets. CISA does not prescribe a universal backup frequency, retention period, recovery point objective (RPO), or recovery time objective (RTO) in the reviewed guidance. An RPO describes how much recent data loss the organization can accept; an RTO describes how long a service can remain unavailable. Set both in light of business impact, data change rate, dependencies, legal obligations, and restoration capacity. A target that has not been tested is an assumption, not a demonstrated recovery capability.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →2. Create separated copies and encrypt them
Maintain multiple copies in physically separate, segmented, or otherwise secure locations. Ensure at least one is offline or strongly isolated from routine production access. Separation is about the route an attacker can use: a copy in another location may still be exposed if the same compromised identity or management interface can delete it.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Encrypt backup data and protect the encryption keys as carefully as the copies themselves. A backup that is encrypted but whose keys are unavailable during recovery may be unusable; keys stored only in a compromised environment may be exposed along with the backup controls. Document who can access keys and how authorized responders can retrieve them during a disaster.
3. Keep backup administration separate
Separate backup administration from ordinary production work. Limit who can change retention, delete copies, alter backup policies, or access management interfaces. Protect backup credentials, use them only where needed, and monitor access and changes. The purpose is to avoid a design in which compromise of a regular production account automatically grants the ability to erase or disable recovery copies.
Review the full access path, not just the backup storage account. Consider which identities can sign in to the management console, change policies, access encryption keys, or control the systems that connect to offline media. A nominally isolated destination offers less protection if a production administrator can remove that isolation or its retention rules.
4. Apply immutability and versioning deliberately
If a storage service supports immutability or object lock, decide whether and how to use it for each backup set. Check who can set or change retention, what happens when retention expires, whether protected objects can be deleted under any administrative or governance process, and how a recovery team will locate the version it needs. Where supported and appropriate, versioning can preserve earlier object versions, but confirm that retention and access controls protect those versions in the way your recovery plan requires.
Before locking data, check the effects on compliance, deletion obligations, and storage cost. Retaining more versions or keeping data immutable for longer may help preserve a clean copy, but may also prevent deletion when required or increase costs. These outcomes depend on the service and its configuration; do not assume that a feature called “immutable” automatically satisfies a regulatory rule or fits your retention policy. Record the chosen behavior and have the appropriate legal, compliance, security, and storage owners review it.
5. Preserve the materials needed to rebuild
Backups of data alone may not be enough to restore a working service. Maintain and update golden images, infrastructure-as-code templates, and the other materials needed to rebuild systems. Where relevant, include source code or executables, license agreements, and software installation materials with offline backups. Keep the instructions and dependencies needed to use those materials accessible to the recovery team.
Document a restoration sequence that identifies prerequisites and order of operations. For example, a service may depend on network, identity, or other infrastructure being available before its application and data can be restored. Use your own dependency inventory to establish that order rather than assuming that restoring files first will make the service usable.
Recommended Free Tools
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
6. Exercise restoration and keep evidence
Test both the availability and integrity of backups in realistic disaster recovery scenarios. Restore representative data and systems, not just a single small file, and check that recovered data is usable and that the rebuilt services function as intended. Record failures, elapsed recovery time, dependencies discovered during the exercise, and any gap between actual results and the recovery targets.
Regular testing is essential, but the guidance does not set one interval for every organization. Set a schedule based on the importance and rate of change of the protected service, its risk, and the time needed to detect drift in the recovery process. Re-test after meaningful changes to backup policies, system architecture, identities, or retention configuration. Treat failures as work items: assign an owner, correct the issue, and test again rather than treating a completed backup job as proof of recoverability.
What does the 3-2-1 backup rule mean?
The 3-2-1 formulation is a redundancy pattern: three copies of data in total, including production data and two backup copies, on two different media, with one copy kept off-site for disaster recovery. A CISA-hosted advisory on LockBit attributes that formulation to Australia’s ACSC. It is a helpful starting point, not a complete ransomware recovery plan.
The rule encourages multiple copies, different media, and geographic separation. It does not by itself say whether an attacker with production credentials can delete the copies, whether older clean versions survive encryption, whether data is encrypted, or whether the organization can restore the systems that depend on it. Offline separation, suitable access controls, retention choices, and restore testing address those additional risks.
Do not treat “off-site” as equivalent to “offline.” A remote copy may still be connected and manageable through accounts or interfaces that an attacker can reach. Likewise, two copies on different media are not necessarily independent if both are controlled by the same compromised credentials. Assess the actual access path and recovery behavior of each copy.
How should I choose between an offline copy, immutable cloud storage, or both?
Choose based on which threats the organization needs to withstand and what it can operate reliably. Compare each design against access by compromised production credentials, survival of earlier clean versions, restoration speed and scale, separation across locations and media, key custody, monitoring, compliance, and cost.
| Question to evaluate | Why it matters |
|---|---|
| Can production credentials reach or delete this copy? | If they can, the copy may share the same failure path as production. Check the identities and interfaces that can administer it. |
| Will an older clean version survive encryption or corruption? | Current copies may contain encrypted or damaged data. Review version history and the protections that prevent earlier versions from being removed. |
| How quickly and at what scale can data be restored? | A protected copy that takes too long to retrieve may not meet business recovery needs. Test representative restores rather than inferring speed from a product feature. |
| How are media and locations separated? | Physical separation, network segmentation, and geographic separation address different risks; document what each copy is isolated from. |
| Who controls encryption keys and backup administration? | Recovery depends on authorized access to keys, while attacker resistance depends on preventing compromised accounts from controlling every copy. |
| Do retention settings fit legal duties and cost constraints? | Immutable retention may prevent premature deletion but can also conflict with obligations or retain data longer than intended. |
An offline copy is a strong option when the organization can manage the physical handling and has a practical way to restore it. Immutable cloud storage may suit organizations that need a protected copy without operating another physical environment, provided administrators understand and review its lock, versioning, retention, and cost behavior. Using both may add independent recovery paths, but also adds processes and controls that must be maintained and tested.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
What should I do with backups during a ransomware incident?
Do not rush to reconnect backup media or restore files to systems that may still be compromised. Follow the incident response plan, contain affected systems, and restore in a controlled sequence using clean recovery systems and verified backups.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Contain affected systems. Follow the organization’s incident response plan and prevent affected systems from continuing to reach other systems or backup destinations.
- Protect remaining recovery copies. Avoid unnecessary access or changes to offline and isolated backups while the incident is being assessed. Preserve the separation that makes them useful.
- Confirm the recovery environment is clean. Rebuild or prepare systems for recovery so that malware or compromised configurations are not carried into restored services.
- Restore in priority order. Use the documented dependency sequence to rebuild critical services and restore from offline encrypted backups or another verified protected copy.
- Validate and document. Check that restored data and systems are usable, capture actual recovery times and problems, and update the recovery plan based on what the incident revealed.
Recovery is not complete simply because files have been copied back. CISA and the FBI’s February 2023 ESXiArgs virtual-machine recovery guidance is a reminder that restoration can involve rebuilding affected systems as well as recovering data. Follow incident-specific technical guidance for the systems involved, and do not assume that one restoration procedure applies to every ransomware event.
How should an individual or small office protect a backup drive?
For an individual or small office, an external hard drive can provide a straightforward backup destination, but it should not remain continuously connected if the goal is to keep a copy beyond the reach of ransomware. CISA’s consumer guidance also names a vetted cloud service as an option and advises safely storing an external drive when disconnected.
- Choose what matters: important documents, photos, and other files you would need to recover.
- Make a backup to an external drive or vetted cloud destination, and check that the files can be opened or restored.
- Disconnect the external drive when it is not actively backing up, then store it safely apart from the computer.
- Use a separate backup or version-history capability if available, and verify how it handles deleted or changed files rather than assuming ordinary sync preserves older copies.
- Practice retrieving a few important files so that you know how to access the copy when needed.
For a business, an external drive or cloud destination is only one part of the design. As the number of systems and dependencies grows, account separation, recovery priorities, retention decisions, and restoration at service scale become essential. A drive that protects a few files is not a substitute for a tested enterprise recovery plan.
Frequently Asked Questions
How often should I test a backup restore?
There is no universal interval in the reviewed CISA guidance. Choose a schedule based on service importance, data change, risk, and the likelihood that configurations or dependencies will drift; also retest after significant changes to the backup or recovery design.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Does a successful backup job mean my data is recoverable?
No. A job can complete while the copy is incomplete, unusable, inaccessible because of missing keys, or too slow to restore for the service’s needs. A restore exercise checks those practical conditions.
Can immutable backups be deleted when retention ends?
That depends on the storage service and the specific retention and governance configuration. Review what happens at expiration, who can change the policy, and how deletion obligations apply before relying on a lock setting.
Should I use cloud sync as my only backup?
Sync alone is risky because encryption or corruption can propagate to synchronized files, as the joint CISA ransomware guide warns. Confirm whether the service preserves independently protected older versions and test how to retrieve them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
