Backups

3-2-1 is the shape: three copies, two media, one off-site. Off-site means out of reach of the credentials and the network that can destroy production. The control is not the backup job. The control is a restore you have actually done. If the NAS uses the same admin as production, ransomware gets both.

First principles

A backup is a copy you can stand a system back up from. Offline or immutable storage is how off-site reach fails closed.

The job is a write. A restore is: pick a date, bring a system back, see that the data is there, write down how long it took. If you have never restored, you have a hope. Ransomware that encrypts the NAS with the same admin you use for the file server is doing you a favour by showing that hope was misplaced.

Same credentials, same blast radius

Domain admin that can log into the backup console is not a backup architecture. It is one identity away from both copies. Immutable object lock, an offline disk you rotate, a cloud account that production cannot write to — those are different identities and different reach. That is the point.

What an admin actually does

• Name what must come back: identity, mail, finance, the systems that mint revenue. Backup those first, not the whole estate as a blob.
• Put a restore on the calendar. A file, a mailbox, a whole host. Record the time. Fix what was slow or missing.
• Split the backup identity from production admin. MFA on the backup console. No standing sync of domain admins into the backup product.
• One copy the ransomware cannot reach: offline, immutable, or a cloud account production roles cannot delete.