Implementing the 3-2-1 Backup Strategy in Real Small and Mid-Sized Businesses

Last month an auto parts export company in Shunyi came to us. The IT manager, Lao Zhou, walked in and sighed: “Our servers are locked, our supplier is chasing us for a quotation, and the customer’s order is stuck. The ransom is 3 bitcoins — should we pay or not?” We have handled at least ten situations like this over the past two years. In the end Lao Zhou did not pay; he chose to restore from backups — but the price was 72 hours of downtime, and once lost business and emergency overtime pay were added up, the total came to more than RMB 400,000. Had their backup strategy been just a little more thorough, that money could have been saved entirely. We are writing about this today not to scare anyone, but to explain, through a real case we lived through ourselves, how small and medium businesses should actually build a backup system.

The 3-2-1 strategy: not dogma, but a baseline

The 3-2-1 backup principle sounds simple: three copies of your data, on two different types of media, with one of them kept off-site. Many people assume this is a game only large enterprises can afford, but that is not the case. Take Lao Zhou’s company. Their original approach was to plug an external hard drive into the server before leaving work each day, copy the data manually and take the drive home. That sounds like it includes an “off-site” copy, but in practice: the drive was often forgotten, the copy was often interrupted, and sometimes it was yanked out halfway through as someone left for the day. With no one checking the logs for three months straight, this kind of “human-powered backup” finally blew up in the sixth month.

The point of three copies is disaster redundancy. The first copy is the original production data; the second is kept locally, on a NAS or a backup server, for fast recovery from high-frequency incidents such as accidental deletion or file corruption; the third must be off-site, either in cloud storage or at another office location. The key is media isolation — if your local backup and your primary data sit on the same physical device, a single ransomware encryption event destroys both copies at once.

As for offline backup, the term comes up a lot these days, because ransomware keeps getting smarter and now actively scans the LAN for mapped drives and backup devices. Once it obtains administrator privileges, even the data on your NAS gets encrypted. Cold backups — offline tape or a fully powered-down drive — therefore remain the last line of defense against advanced threats. For a small or medium business, unplugging a backup drive and taking it home before leaving work on Friday takes five minutes and can save the company.

RTO and RPO: answer two questions before you start

Before planning a backup architecture, IT leaders must align with the business owner on two numbers: RTO (recovery time objective) and RPO (recovery point objective). RTO means “how long between the disaster and the business being back online can I tolerate at most”; RPO means “how much data, measured in time, can I afford to lose at most”. These two figures directly determine what kind of backup solution you need.

We usually ask clients three questions: if your core business system goes down for an hour, roughly how much do you lose? Can you accept losing a full day of yesterday’s data, or only the last hour’s worth? And how much budget do you have today for data protection? The answers make a huge difference to the design.

1. If RTO must be within 4 hours and RPO within 1 hour, you need real-time replication or near-real-time continuous data protection (CDP). This costs more, but the business interruption is almost imperceptible;
2. If RTO is within one day and RPO is 24 hours, one full backup a day plus incremental backups every few hours is enough, and the cost can be kept low;
3. If the business can tolerate several days of downtime, the backup strategy can be simpler — but in that case make sure the offline copy is secure, because a long outage gives an attacker a wider window.

An education and training company in Daxing felt its business was “not that critical” and set an RTO of 72 hours. After their server was hit late last year, they discovered that their backups ran once a week on Sunday, so data encrypted on Wednesday had to be restored to the previous Sunday’s state — three days of enrollment records and course-change records were gone. The parent chat groups erupted, and between refunds and the cost of re-recording the courses, the loss far exceeded the price of a professional backup product.

How to choose backup software: the right fit is the right choice

Backup software on the market ranges from free to several hundred thousand yuan. Small and medium businesses most often fall into two traps: buying a feature-heavy “enterprise-grade” product that their IT staff never fully use, with eighty percent of its features gathering dust; or choosing an obscure open-source tool to save money, then finding no technical support when problems arise and documentation last updated five years ago.

Our recommended selection logic for small and medium businesses is this: first, check operating system compatibility — are your servers Windows or Linux, your databases MySQL or SQL Server — because that determines whether the software will even run; second, check whether the recovery scenarios are fully covered — file-level recovery, bare-metal recovery and point-in-time database recovery; you should support at least two of the three; third, look at management complexity — if it can be operated through a graphical interface, do not choose a command-line-only tool, and if it can manage multiple machines centrally, do not configure them one by one.

If your company already has a Network Equipment Package service contract, the backup system can usually be planned together with it — unified policy distribution, unified monitoring and alerting — which makes ongoing operations much easier.

An anonymized case: the 72 hours at that Shunyi factory

Back to Lao Zhou’s company from the beginning. Their IT environment looked like this: one physical server running ERP and file sharing, protected by the server’s built-in RAID 1 plus a portable hard drive copied manually every day. The entry point was a phishing email — an administrative assistant clicked on a “delivery confirmation” — and the malware lay dormant for two days before spreading laterally during Friday evening’s peak hours, encrypting every shared file the server could reach.

When IT investigated the next morning, they found that one of the two disks in the RAID array had gone offline at some unknown point, leaving only a single-disk copy, and the portable hard drive was still plugged into the server’s USB port — so it was encrypted along with everything else. What could they do? They had to restore from a cloud backup that was three months old. Because it was a full backup, recovery was slow, and on top of buying a new server, redeploying the system and importing the data, several folders of the backup turned out to be corrupt and had to be re-entered by hand. For three full days, the business was essentially at a standstill.

Looking back afterwards, they made three changes: first, they moved to cloud backup with immutability, so that no level of administrator privilege can delete backup copies within 30 days; second, they placed the backup NAS in its own VLAN isolated from the production network, so ransomware cannot scan it directly; third, they instituted a monthly restore drill to verify that the backups are usable. The investment came to a bit over RMB 30,000, and in return: even if they are hit again, they lose at most one hour of data and can restore core business within 8 hours.

Data backup is one of those things whose importance you only appreciate after something goes wrong. The smart approach is to trade a small investment for a large safeguard, rather than doing the math after an incident has already happened. If you are evaluating your own company’s backup plan and are unsure about something, contact us and we will walk through your current setup with you to see where the gaps are.