Not logged in » Login
Oct 31 2018

3-2-1 Backups: Hopelessly Outdated or Still Relevant?


Concerns about adequate backup and data protection strategies have plagued IT departments for almost as long as they exist. That's no surprise; after all, questions like "How many copies of my data do I have to keep?" and "How can I assure these copies are available when necessary?" are among those that make immediate sense to everyone, regardless of individual computer savvy. Consequently, they have laid the groundwork for numerous debates, which became more urgent as storage technology evolved and prompted IT teams as well as regular users to search for the one solution that would cure all backup and data protection issues in one fell swoop. The problem with this quest is that such a cure-all doesn't exist – at the end of the day, each organization will have to come up with a policy and implementation strategy that best suits its own specific needs.

This point has been proven time and again in recent years, especially with regard to a very popular form of digital aggression, the so-called ransomware attacks. Essentially a form of blackmail, this type of onslaught has been around since the late 1980s and involves infecting target systems with a special type of Trojan that encrypts (or purports to encrypt) information residing on a hard drive or SSD and confronts users with a lock screen displaying the modern-day equivalent of a ransom note. The note typically alleges what has happened and which sum in bitcoins or another cryptocurrency the victim is expected to pay to the anonymous attacker and until when, in exchange for the decryption key(s) that enable her or him to once again access their data. Such a raid can already have dramatic effects in a private setting, but will lead to absolute disaster if businesses or public services are affected: According to Europol's latest Internet Organised Crime Threat Assessment report (IOCTA), just last year a ransomware named WannaCry infected up to 300,000 systems in more than 150 countries, among them computers run by hospitals, public transportation services and telecom carriers. Not surprisingly, many victims, especially in the healthcare sector, decided to pay rather than run the risk of being unable to provide adequate therapy and medication.

3-2-1: The Popular Defense Against Data Loss and Blackmail
In hindsight, it turned out that quite a few organizations could have avoided succumbing to the pressure if proper data protection measures had been in place. One simple, but increasingly popular approach that can help organizations to fend off ransomware attacks is the 3-2-1 backup method, which means they ought to keep three copies of data on two different types of storage media, with one copy being laid away in a remote location. The logic behind this concept is easy to understand, but effective: With a 3-2-1 approach, companies can protect their most crucial information in a way that ensures that at least one copy survives, even if the other two are lost, destroyed or, as in our example, encrypted in a ransomware attack. Still, in order to function properly and yield the desired results, it cannot and should not be applied to all datasets across the board, regardless of their importance. Instead, it must be incorporated into a broader data protection policy, which in turn must be flexible enough to implement adequate protection levels for data of different value.

Data Classification
That's precisely where data classification comes into play: Prior to adopting a policy, every organization needs to analyze what types of data it stores for which reasons and purposes, and how critical these bits and bytes are when it comes to carrying out its business. The results of this evaluation then determine how many copies they have to keep for how long and whether it makes sense to use the strongest protective measures or to be a little more lenient. For example, healthcare institutions will want to apply the highest standards to their patients' records because a. they provide the basis for all treatments, therapies and billings and b. it's required by law and international standards. In other words, sometimes the 3-2-1 approach may not be good enough and should be replaced with a more sophisticated method, whereas in another context it may amount to overkill – emails in which employees arrange to meet for coffee may almost always be removed afterwards, simply because they lack relevance.

The Costs and Benefits of Adequate Backups
Once the classification process is finished, it soon becomes clear exactly how many copies an organization needs to keep, how long it will take to run the necessary backups, and which type of storage infrastructure is needed to implement their tailor-made version of 3-2-1 in an efficient and timely manner. Once they've reached this point, there's only one last obstacle left to overcome: disproportionate cost consciousness. In the end, however, security considerations will prevail, simply because the considerable costs of an upfront investment in proper hardware and processes pale in comparison to the financial losses and reputational ruin a company could face after falling victim to a ransomware attack without having an adequate, protective backup and recovery method in place. In contrast, being prepared can transform a ransomware strike from a potential catastrophe into a mere inconvenience.

Customers who wish to protect themselves against ransomware attacks and other security challenges should waste no time and turn to Fujitsu or one of our channel partners for help. Not only will we work closely with you to establish holistic protection policies and mechanisms that meet your individual risk profile – we also offer a comprehensive portfolio of products, solutions and services that minimize possible harm and can even stop attackers dead in their tracks. Our offerings include data protection appliances, hybrid storage systems, all-flash arrays, tape libraries, hyperscale systems, and all the software tools that let them work correctly so that you can sleep at night. To find out why we take pride in being a one-stop shop for all security and backup needs, just stop by at the Fujitsu Forum in Munich next week (November 7 and 8).

Richard Schneider


About the Author:

Richard Schneider

Global Product Marketing – Storage


Comments on this article

No comments yet.

Please Login to leave a comment.


Please login

Please log in with your Fujitsu Partner Account.


» Forgot password

Register now

If you do not have a Fujitsu Partner Account, please register for a new account.

» Register now