Everyone agrees that backups are important. Far fewer people actually test their backups, and fewer still have a strategy that accounts for both data loss and data exposure. In a cloud-first world, the challenge is not just making copies of your data but making copies that are resilient, recoverable, and not themselves a security liability.
The 3-2-1 Rule Applied to Cloud
The 3-2-1 backup rule is the foundational principle of data protection: maintain at least three copies of your data, on at least two different types of media, with at least one copy stored offsite. This rule predates cloud computing, but it adapts naturally to modern infrastructure.
In a cloud context, the 3-2-1 rule might look like this:
- Copy 1: Your working files on your local machine or primary cloud service (Google Drive, Dropbox)
- Copy 2: An automated backup to a different cloud provider (Backblaze, AWS S3, or a secondary cloud storage)
- Copy 3: An encrypted local backup on an external hard drive or NAS stored in a different physical location
The critical insight is that syncing is not the same as backing up. If you delete a file from Google Drive, the sync client deletes it from your computer too. If ransomware encrypts your local files, the encrypted versions sync to the cloud. A true backup is an independent copy that is not automatically modified when the original changes.
Versioning and Snapshots
Versioning maintains previous versions of your files so you can recover from unwanted changes. Most cloud providers offer some form of version history:
- Google Drive keeps version history for 30 days (or up to 100 versions)
- Dropbox maintains 30 days of version history (180 days on Professional plans)
- OneDrive keeps version history for all file types, not just Office documents
- AWS S3 supports bucket-level versioning that retains every version of every object
Snapshots go further by capturing the entire state of a system or storage volume at a point in time. Cloud providers like AWS, Azure, and Google Cloud offer snapshot capabilities for virtual machines and storage volumes. Snapshots are particularly valuable because they allow you to restore an entire environment to a known-good state, not just individual files.
The security consideration with versioning is that deleted files are not truly deleted until the version history window expires. Sensitive data you thought you removed may still be accessible through version history. When handling truly sensitive information, verify that version history has been purged after deletion.
Automated vs. Manual Backups
The best backup is the one that actually happens. Manual backups require discipline that most people do not sustain. You remember to back up after a scare, maintain the habit for a few weeks, then gradually forget until the next crisis.
Automated backups remove human unreliability from the equation. Tools and approaches include:
- Time Machine (macOS) or File History (Windows) for continuous local backups
- Backblaze for automatic, continuous cloud backup of your entire computer
- rclone for scheduled synchronization between cloud providers (free, open-source)
- Duplicati for encrypted, incremental backups to multiple cloud destinations
- Cloud-to-cloud backup services like Spanning or Backupify for backing up SaaS data (Google Workspace, Microsoft 365, Salesforce)
Automation should include notification on failure. A backup that silently stops working for three months is worse than no backup at all because it creates false confidence.
Cross-Provider Redundancy
Storing all your backups with a single cloud provider creates a single point of failure. If your Google account is suspended (which happens, sometimes erroneously), you lose access to both your primary data in Google Drive and your backups if they are also in Google's ecosystem.
Cross-provider redundancy means distributing your backups across at least two independent cloud providers. Your primary files might be in Google Drive, but your backup goes to Backblaze B2 or AWS S3. If one provider experiences an outage, a policy change, or an account issue, your data remains accessible through the other.
When implementing cross-provider redundancy, encrypt your backups before uploading them. This way, even if a secondary provider is breached, your backup data remains protected. Tools like Cryptomator, rclone with crypt, or Duplicati handle encryption transparently.
Testing Your Restores
A backup you have never restored is a backup you cannot trust. The single most important and most neglected step in any backup strategy is regularly testing restores.
Testing should verify:
- Completeness: Are all expected files present in the backup?
- Integrity: Can the files be opened and read without corruption?
- Timeliness: How long does a full restore take? Is this acceptable for your needs?
- Usability: Can you actually follow the restore process under pressure, or does it require expertise you do not have?
Schedule restore tests quarterly. Pick a random set of files from your backup and verify you can recover them. Once a year, do a complete restore to a clean machine to verify the entire process works end to end.
Balancing Convenience and Security
Every copy of your data is both a safety net and an exposure risk. A backup on a cloud server is a copy of your data that could be breached. An encrypted backup on an external drive sitting on your desk is a copy that could be stolen.
The balance comes from layered protection:
- Encrypt all backups at rest using a strong password you store in your password manager.
- Use separate credentials for your backup accounts. If your primary account is compromised, the attacker should not automatically gain access to your backups.
- Apply retention limits. Do you really need backups from three years ago? Old backups contain old data that may include information you would rather not have floating around.
- Secure physical backups in a locked location or a fireproof safe. An external drive with your entire digital life should not sit on a shelf in an unlocked office.
A well-designed backup strategy gives you confidence that your data will survive hardware failure, ransomware, accidental deletion, and account compromise without creating unnecessary copies that expand your attack surface.