Cybersecurity Foundations (Grades 6–8) · lesson 35 of 48 · 8 min
Backups: Your Last Line of Defence
Every other security control can fail. Antivirus can miss new malware. Firewalls can be bypassed. Passwords can be stolen. But a clean, tested backup is the one defence that guarantees recovery — no matter what happens to your original data.
Ransomware has made backups more important than ever. When ransomware encrypts your files and demands payment, the only way to recover without paying is a backup that was made before the attack. Without one, victims face an impossible choice: pay criminals or lose everything.
By the end of this lesson you will be able to explain the 3-2-1 backup rule, compare backup types, identify what makes a backup reliable, and outline a basic recovery plan.
Ransomware reality
Ransomware attacks cost businesses and individuals billions of dollars each year. The average ransom demand has exceeded $1 million for organisations. For individuals, losing irreplaceable photos, schoolwork, or personal files can be devastating. A backup makes ransomware nearly powerless — but only if the backup was made before the attack and is not connected to the infected system.
Why Backups Are a Security Control
A backup is a copy of your data stored separately from the original. Backups are not just for accidental deletion — they are a critical defence against ransomware, hardware failure, theft, and natural disasters.
Ransomware attacks encrypt your files and demand payment to restore them. If you have a clean backup, you can restore your files without paying the ransom. Without a backup, victims often lose everything or pay thousands of dollars.
The 3-2-1 Backup Rule
The 3-2-1 rule is the gold standard for backup strategy:
Why offsite matters
If your home floods, burns, or is burgled, an external drive sitting next to your computer is lost along with everything else. An offsite or cloud backup survives physical disasters.
Backup Types
What Makes a Good Backup?
Recovery Planning
Having a backup is only half the plan. You also need to know how to use it. A recovery plan answers these questions before a disaster happens:
Knowledge Check
Backups and Recovery
What does the “1” in the 3-2-1 backup rule mean?
- Keep 1 backup total
- Keep 1 copy offsite or in the cloud
- Back up once per week
- Use 1 type of storage media
Answer: Keep 1 copy offsite or in the cloud
The offsite copy protects against physical disasters like fire, flood, or theft that would destroy both your original and a local backup.
Why does ransomware make backups so important?
- Ransomware deletes backups automatically
- A clean backup lets you restore files without paying the ransom
- Backups prevent ransomware from running
- Ransomware only attacks computers without backups
Answer: A clean backup lets you restore files without paying the ransom
Ransomware encrypts your files and demands payment. If you have a clean backup from before the attack, you can restore without paying.
A backup you have never tested is guaranteed to work when you need it.
- True
- False
Answer: False
Backups can fail silently — corrupted files, wrong settings, or software incompatibility. Always test your backup by restoring a file periodically.
Which backup type only copies files changed since the last backup of any kind?
- Full backup
- Differential backup
- Incremental backup
- System image
Answer: Incremental backup
Incremental backups copy only what changed since the last backup (full or incremental), making them fast and storage-efficient.
To protect a backup from ransomware that could encrypt connected drives, keep at least one _____ copy that is not connected to your network.
Answer: offline
An offline backup cannot be reached by ransomware running on your computer. It is the most reliable protection against ransomware destroying your backups.
Real-World Case Studies
Case 1: Colonial Pipeline — Ransomware and the Backup Question
In May 2021, Colonial Pipeline — which supplies 45% of the US East Coast’s fuel — was hit by the DarkSide ransomware. The company paid $4.4 million in ransom (the FBI later recovered $2.3 million). The attack caused fuel shortages across the southeastern US, with gas stations running dry and prices spiking. The root cause was a compromised VPN password. The lesson: even large organisations with security teams can be hit. Colonial’s decision to pay suggests their backup and recovery capabilities were insufficient to restore operations quickly enough.
Case 2: The School District That Refused to Pay
In 2019, the Rockville Centre School District in New York was hit by ransomware. Attackers demanded $176,000. The district refused to pay — because they had backups. They restored their systems from backup within days and paid nothing. Compare this to the Baltimore City government, which was hit by ransomware the same year, had inadequate backups, and spent over $18 million on recovery. The lesson: a good backup strategy is not just a technical decision — it is a financial one. The cost of backups is trivial compared to the cost of not having them.
Previous lesson: Security updates explained
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Device security checklist