THREAT‑WATCH
Glossary
Backup and Recovery
Maintaining copies of data separate from production systems, and the process of restoring from them after data loss or a ransomware attack.
Effective backup strategy typically follows the '3-2-1' principle: three copies of data, on two different media types, with one copy offline or immutable. That offline/immutable copy matters specifically because ransomware routinely targets connected backups first, encrypting or deleting them before encrypting production data, to remove the victim's ability to recover without paying.