Is an external hard drive enough as a backup?

Not as your only backup. A drive that is always attached to the PC can be encrypted by ransomware, and a loose drive can fail or get lost. As an extra offline copy next to an automatic backup, a drive can be useful, as long as you unplug it after every backup and keep it somewhere else.

What does an immutable backup mean?

An immutable backup is protected against deletion and changes for a fixed period. Even someone with admin rights cannot remove it during that time. That way a clean copy remains, even if an attacker has taken over your admin account.

Does Microsoft automatically back up my Microsoft 365?

Microsoft keeps the service available and offers recycle bins and version history, but that is not a full backup you control yourself. For longer retention and recovery after an attack or a mistake, a separate backup of your Microsoft 365 environment is sensible.

How often should I test a restore?

For a small SME, a real restore test at least once a year is already a big step. If you have a lot of critical data, test more often in smaller pieces, for example a folder or a mailbox every quarter.

Backups and ransomware: why an SME needs an offline or immutable copy

In many ransomware attacks the most important work happens before the encryption. The attacker looks around, finds the backups and deletes or encrypts them first. Only then are the files locked. If all you have at that point is a backup that can be reached with the same account, you are left empty-handed. A backup only really helps against ransomware if there is at least one copy the attacker cannot reach.

Why ransomware goes after your backups first

Criminals who use ransomware know that a good backup ruins their business model. If you can restore everything, you do not pay. That is why deleting backups has become a standard step. An attacker who gets in through a compromised account or an insecure laptop looks for a NAS on the network, an attached backup drive or the console of your backup software. If they can log in there, the backups are often gone within minutes.

That is easiest when the backup can be reached with the same account as everything else. Think of a NAS mapped as a network drive on every PC, a USB drive that is always attached to the server, or a backup console you log in to with your normal Microsoft 365 account without any extra check.

The 3-2-1 rule in plain language

The 3-2-1 rule is an old, simple rule of thumb that still holds:

Three copies: the original data plus two backups.
Two types of storage: for example a local drive or NAS and cloud storage next to it. If one type fails, you still have the other.
One copy off site: in case of fire, burglary or water damage at the office, you do not want every copy in the same building.

These days the rule is often extended to 3-2-1-1-0. The extra 1 stands for one copy that is offline or immutable. The 0 stands for zero errors when restoring: you have tested that recovery works.

Offline or immutable: what is the difference?

An offline copy is physically disconnected, such as an external drive you unplug after the backup and take with you. Simple and cheap, but it only works if someone does it consistently. A drive that stays plugged in “for a while” is no longer an offline copy.

An immutable copy is online, but protected against deletion and overwriting for a fixed period. Even an administrator cannot remove it during that time. Many cloud backup services offer this. For most SMEs it is more practical than swapping drives, because it happens automatically.

Cloud sync such as OneDrive is not a replacement either. Encrypted files simply sync along. The recycle bin and version history sometimes help, but they were not designed as a backup against a targeted attack.

Separate access to your backup

A backup is only as strong as the account that can manage it. Pay attention to these points:

Use a separate account for the backup software or console, not an employee's everyday account and not a password used elsewhere.
Always turn on multi-factor authentication (MFA) for that account.
Do not map a NAS as a permanent network drive on every PC. Only let the backup software reach it.
Limit who is an administrator. The fewer admin accounts and local admin rights, the smaller the chance an attacker gets far.
Have an alert sent when backups fail or when someone deletes backups or shortens the retention period.

How far back do you need to go?

Attackers sometimes sit in a network for days or weeks before they strike. If you only keep a few days of backups, every copy may already be infected or already missing files. Agree on a retention period that suits your business, for example daily backups for a few weeks plus weekly or monthly points that are kept longer. Do not forget the email and documents in Microsoft 365. Retention policies in Microsoft 365 help against accidental deletion, but they are not the same as a separate backup of your environment.

Testing: the 0 in 3-2-1-1-0

A backup nobody knows can be restored is a hope. So test a real restore regularly: a folder, a mailbox or a whole workstation, to a test location. Write down how long it took and how far back you could go. How to set that up is covered in testing backups with a practice restore. Record in your IT incident plan who may start a restore and where the backup credentials are kept if your normal accounts no longer work. Insurers increasingly ask about this too in the cyber insurance questionnaire.

A quick check of your own backup

Ask yourself these five questions: do you have at least three copies, is one of them off site, is there one nobody can delete, does the backup have its own credentials with MFA, and have you actually restored something in the past year? If the answer anywhere is no or “I don't know”, that is the first thing to fix.

What Floor ICT does

In the Elite package, Floor ICT manages workstation backup with Acronis Cyber Protect, which also provides the antivirus. We check that backups succeed, keep management separate from everyday accounts and plan a practice restore together with you. The Advanced package includes antivirus and ransomware protection but no backup; Essential focuses on monitoring and remote support. Backup of the Microsoft 365 environment itself, such as email, OneDrive and SharePoint, is agreed separately. Tell us in the intake which data is critical for you, and we will set up the backup accordingly.

View MSP packages Request an intake Microsoft 365