Additional resource for the lesson “Data Backup: The Protection That Works Afterwards” — Online Security course
Everything else in this course tries to prevent something. Data backup is the one measure that works after it has already happened — which is why it is the last line, and the one worth setting up before you need it.
A. Why this matters
Hardware fails. Phones are lost and stolen. Ransomware encrypts files. People delete the wrong folder. None of these is unusual, and none of them can be entirely prevented.
A backup turns each of them from a loss into an inconvenience. It is the only measure in this course that helps after something has already gone wrong.
The key idea: a backup is not a copy sitting on the same computer. It is a copy that survives whatever happens to the original — which usually means at least one copy that is not connected.
B. Key concepts
Six ideas, including the two that decide whether a backup actually works.
The 3-2-1 rule
Three copies of anything that matters, on two different kinds of storage, with one kept somewhere else.
Why it matters to you: It sounds elaborate and usually is not: the original on your computer, a copy in the cloud, and an external drive is already 3-2-1 for most households.
Why one copy must be offline
Ransomware encrypts everything it can reach — including connected drives and, in some cases, synchronised cloud folders.
Why it matters to you: This is the reason ‘it syncs to the cloud’ is not by itself a backup. A drive that is disconnected between backups cannot be reached by anything running on the computer.
Synchronisation is not backup
Cloud sync mirrors changes, including deletions and encryption, to every device.
Why it matters to you: A deleted file disappears everywhere; an encrypted file syncs as encrypted. Useful, valuable, and not a backup by itself.
Version history
The ability to recover an earlier version of a file, offered by most cloud services and some backup tools.
Why it matters to you: This is what rescues you from the sync problem above, and it usually has a time limit. Knowing yours — thirty days, ninety, longer — is worth two minutes.
Automatic backup
Backup that runs on a schedule without you initiating it.
Why it matters to you: A manual backup is a backup that stops happening within about three weeks. Automation is what makes the difference between a plan and a habit.
The restore test
Actually recovering a file from your backup to confirm it works.
Why it matters to you: This is the step nobody performs and the only one that proves anything. A backup that has never been tested is a hypothesis.
C. A practical example: three copies, one Tuesday
A laptop stops working. On it: several years of photographs, work documents, and correspondence.
With sync only
- The files are in the cloud, so most of them are recoverable.
- But anything excluded from the synced folder is gone, and people rarely know exactly what was excluded.
With 3-2-1
- The originals are gone with the laptop.
- The cloud copy is available immediately.
- The external drive in a drawer holds everything, including what was never synced.
Recovery takes an afternoon rather than being a permanent loss.
The ransomware case, which is different
Files are encrypted rather than lost. The cloud copy may have synced the encrypted versions. The external drive, disconnected since the last backup, has not — which is precisely why one copy stays offline.
The disconnected copy is the whole reason for the rule. It is also the part people drop first, because it requires plugging something in.
D. Try it yourself: set it up, then test it
An hour to set up, ten minutes to test. The test is not optional.
Step 1 — Decide what actually matters
- Photographs, documents, work files, anything you could not reproduce.
- Not the operating system or applications, which can be reinstalled.
Step 2 — Set up automatic backup
- Phone: the built-in backup to your account, checked to confirm it is running and what it includes.
- Computer: the built-in tool — Time Machine, File History — to an external drive, plus a cloud service.
Step 3 — Add the offline copy
- An external drive that stays disconnected between backups.
- Once a month is enough for most people. Put it in the calendar.
Step 4 — Test the restore
- Pick a file. Delete your working copy. Recover it from the backup.
- If that does not work, you have found out today rather than on the day it matters.
Step 5 — Check your version history window
- How far back can your cloud service go? Thirty days is common.
- This determines how long you have to notice a problem.
Step 4 is what separates a backup from an intention. Most people who lose data had something they believed was a backup.
E. Videos, articles and further resources
Independent and institutional sources in English.
NCSC (UK) — Backing up your data
What to back up and how often, from the UK national authority. Short and practical.
https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/always-back-up-your-most-important-data
NCSC (UK) — Responding to a ransomware attack
Why the offline copy matters specifically, and what to do if files are already encrypted.
https://www.ncsc.gov.uk/section/respond-recover/ransomware-attack
EFF — Keeping your data safe
Backup and encryption together, which is the subject of the companion resource.
https://ssd.eff.org/module/keeping-your-data-safe
CISA — Secure Our World
The US cyber security agency’s public programme: four basic actions, explained for people who are not IT professionals.
https://www.cisa.gov/secure-our-world
NCSC (UK) — Top tips for staying secure online
Six short pieces of advice from the UK’s national cyber security authority. A good starting point if you want the essentials without the jargon.
https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online
FTC — Malware: how to protect against, detect and remove it
The signs that something is wrong with a device, and the sequence to follow to clean it.
https://consumer.ftc.gov/articles/malware-how-protect-against-detect-and-remove-it
Links checked in August 2026.
F. The Cyber Welfare Framework: Skills, Awareness, Secure Behavior
This lesson sits on the Secure Behavior pillar at level FL2, and is the practical basis of digital resilience.
Skills
- Setting up automatic backup on a phone and a computer.
- Maintaining an offline copy on a schedule.
- Performing a restore test.
For professionals and organizations
- Testing restores periodically rather than assuming the backup works, which is where most organizational failures occur.
Awareness
- Understanding that synchronisation is not backup.
- Recognising why one copy must be disconnected.
- Knowing that an untested backup is an assumption.
For future instructors and ambassadors
- Leading with the restore test. It is the part that changes behaviour, because people discover their backup does not cover what they thought.
Secure Behavior
- Keeping backup automatic rather than manual.
- Connecting the offline drive on a schedule.
- Testing recovery once or twice a year.
For organizations
- Keeping at least one backup copy offline or otherwise unreachable from the systems it protects.
G. Questions to sit with
- If your laptop stopped working this afternoon, what would you lose?
- Have you ever recovered a file from your backup, or do you assume you could?
- Is any copy of your data disconnected right now?
- How far back does your cloud service let you recover a previous version?
H. What to do now
The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply to data.
Backup
- R19 — Keep a periodic backup of the data that matters to you.
- R6 — Keep backup software and devices updated.
Minimum commitment: Three copies, two kinds of storage, one disconnected. Then test the restore.
What backup does not replace
- R17 — Do not open attachments from unknown sources: the most common route to ransomware.
- R1, R2, R4 — Unique credentials and multi-factor authentication on the account holding your cloud backup.
- R7, R5, MS4 — A locked device, since the backup is only as private as the device that can reach it.
In short
- Backup is the only measure that helps after something has gone wrong.
- Synchronisation is not backup: deletions and encryption sync too.
- One copy must be disconnected — that is the part that survives ransomware.
- Test the restore. An untested backup is a hypothesis.
Related resources in this course
Protecting the data, and protecting who can read it:
- Data Encryption: An Essential Tool for Data Protection
- Download Security: Deciding Before You Install
- Device Lock: The Barrier Everything Else Sits Behind
Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.
If you would like to follow the whole path, the Cyber Welfare Program is free and open to everyone.
Leave a Reply