Why Your 3-2-1 Rule Needs a Fourth Layer of Protection
The classic 3-2-1 backup rule (three copies, two media types, one offsite) has served us well. But in the era of wiper malware and zero-day exploits, even that framework falls short without an isolation component. That missing piece is Air Gapped a copy that resides in a network-unreachable state during normal operations, ensuring that no remote attacker can corrupt it. Breaking the Permanent Connection Habit Most backup targets — NAS devices, cloud buckets, secondary SANs remain persistently connected. Attackers discover them, map them, and encrypt them alongside production data. Breaking this habit requires rethinking backup windows: connect only to write, then disconnect entirely. Physical vs. Logical Isolation Methods Physical isolation involves removable drives, tape cartridges, or offline servers that require a human to power or cable them. Logical isolation uses software-defined controls like storage firewalls that disable network paths until a recovery workfl...