Lesson 7 of 9 · about 15 minutes

Protecting Files: Backups, Encryption and Ransomware

You'll be able to

Apply the 3-2-1 backup rule to a writer's files
Tell syncing apart from backing up
Choose encryption for local drives and cloud storage
Plan and test a restore, and keep one copy out of ransomware's reach

Hard drives fail. Laptops get stolen, dropped and coffee'd. Ransomware scrambles everything it can reach. Each of these is survivable if you have a recent copy somewhere else, and a disaster if you don't. Backups are the least glamorous part of security and the one you will be most grateful for.

The 3-2-1 rule

CISA describes the 3-2-1 rule as "a trusted guideline": three copies of important files, on two different types of storage, with one copy off-site (CISA). For a writer, that might look like this:

The second drive can live in your house. The off-site copy protects you from fire, flood and burglary, which tend to take the laptop and the backup drive sitting next to it at the same time.

Sync is not backup

Dropbox, Google Drive, OneDrive and iCloud Drive are sync services first. Delete a file on your laptop, and it disappears from the cloud too. If ransomware encrypts your synced folder, the encrypted junk syncs up and replaces the good copies. Most of these services keep deleted files and old versions for a limited time, which helps, but you should know your service's window before you need it.

A real backup keeps versions. Time Machine on a Mac, File History on Windows, and dedicated backup services keep snapshots going back weeks or months, so you can restore the file as it was last Tuesday.

Cloud or local?

	Local external drive	Cloud backup or storage
Speed to restore	Fast, limited by the cable	Slow for large amounts, limited by your internet
Off-site	Only if you carry it somewhere	Yes, automatically
Who can read it	Anyone who holds it, unless encrypted	The provider, unless end-to-end encrypted
Legal demands	Must be served on you	Can be served on the provider
Ransomware risk	Low if unplugged between backups	Depends on versioning and whether deletion syncs
Cost	One-time drive purchase	Monthly or yearly subscription

Example: the upload math

Rosa produces a podcast about the invented Pell River valley. Her raw audio, video and notes total 300 GB. Her home internet uploads at about 20 megabits per second.

Convert gigabytes to megabits: 300 GB x 1,000 MB per GB x 8 bits per byte = 2,400,000 megabits.
Divide by the upload speed: 2,400,000 / 20 = 120,000 seconds.
Convert to hours: 120,000 / 3,600 = about 33 hours.

So the first cloud backup will run for a day and a half. After that, only new and changed files go up. A restore of everything would take about as long the other way, which is exactly why she also keeps a local drive. The local copy is for speed; the cloud copy is for the house fire.

Encrypt the copies

A backup drive with your source notes on it is a second laptop a burglar can walk off with. Encrypt it.

Mac: Time Machine offers "Encrypt backups" when you choose the disk. Turn it on and save the password in your password manager.
Windows: BitLocker To Go encrypts external drives on Pro editions. On Home, use a backup tool with built-in encryption.
Cross-platform: VeraCrypt, a free open-source tool, creates encrypted volumes that open on Windows, Mac and Linux.
Cloud: Pick a service that offers end-to-end encryption, or encrypt files before upload.

Apple's Advanced Data Protection is a good example of what to check. With it on, Apple says end-to-end encryption covers 25 categories of iCloud data instead of 15, adding iCloud Backup, Photos and Notes. iCloud Mail, Contacts and Calendars stay under standard protection, and you must set up a recovery contact or recovery key first because Apple can no longer recover the data for you (Apple).

Encryption cuts both ways. Lose the password or recovery key and your backup is as unreadable to you as it is to a thief. Store recovery keys on paper, with your two-factor backup codes.

Ransomware

Ransomware encrypts every file it can reach and leaves a note demanding payment, usually in cryptocurrency. Newer gangs also steal the files first and threaten to publish them. For a writer that could mean unpublished drafts and source material.

CISA's #StopRansomware Guide says to "maintain offline, encrypted backups of critical data" and to test them regularly. The reason: "many ransomware variants attempt to find and subsequently delete or encrypt accessible backups." An external drive that is plugged in all the time is accessible. Plug it in, back up, unplug it.

If it happens to you, CISA's response steps adapted for one person:

Disconnect the infected machine from the internet and from any backup drive right away.
Do not plug your backup drive into the infected machine.
Photograph the ransom note and record the time.
Report to the FBI through ic3.gov. CISA suggests checking with law enforcement about whether a free decryptor exists.
Wipe and reinstall the operating system, or have a professional do it, before restoring from a clean backup.
Change passwords from a different, clean device, since the malware may have captured them.

Common mix-ups

Claim: "My files are in the cloud, so they're backed up." What the evidence shows: Sync copies mistakes and ransomware damage too. You need versioning and at least one copy that sync cannot touch.
Claim: "I back up, so I'm fine." What the evidence shows: CISA tells organizations to test backups because untested ones often fail at the worst moment. A backup you have never restored from is a hope.
Claim: "Ransomware only hits big companies and hospitals." What the evidence shows: Big victims make the news. Individuals and small offices are hit by the same automated tools and rarely report it.

Reporting angle

When a city, school district or county gets hit by ransomware, ask for: the date the attack was detected and when systems came back; whether backups were offline and whether they worked; whether a ransom was demanded or paid and by whom (insurer, agency); what data was taken and whether residents were notified under the state's breach notification law; the incident response contract and its cost; and any after-action report. Check whether the agency reported to CISA or the FBI. Compare the official timeline to when residents first noticed services were down.

Checklist

Three copies of important files exist
Two media types: local disk plus cloud, or two different drives
One copy lives off-site
Backup drive encrypted and unplugged between runs
Cloud backup keeps versions; you know how far back
You restored at least one file this month to prove it works

Try it

Write down where every copy of your work lives today: laptop, phone, cloud folders, drives, email attachments. Count how many of the 3-2-1 boxes you actually check. Then do the upload math for your own files using your real upload speed (run any speed test). Set up whatever is missing, and finish with a restore test: delete a copy of a non-critical file from your laptop and bring it back from each backup. Write down how long each restore took.

Check yourself

1. What does the 3-2-1 rule mean, as CISA describes it?

2. Why is a folder that syncs to the cloud not a full backup by itself?

3. Why does CISA recommend offline backups against ransomware?

4. About how long would 300 GB take to upload at a steady 20 megabits per second?

5. With Apple's Advanced Data Protection turned on, which of these stays under standard protection, with Apple holding the keys?

Terms in this lesson

3-2-1 rule: Keep three copies of important files, on two different kinds of storage, with one copy off-site.
Sync: Keeping the same files identical across devices, so a change or deletion in one place happens everywhere.
Versioning: Keeping earlier copies of a file so you can go back to how it was before a change.
Ransomware: Malware that encrypts your files and demands payment for the key.
Restore test: Actually recovering files from a backup to prove the backup works.

Full glossary

Sources

CISA, Back Up Business Data checked 2026-10
CISA, #StopRansomware Guide checked 2026-10
Apple, iCloud data security overview (Advanced Data Protection) checked 2026-10
FBI Internet Crime Complaint Center, 2025 IC3 Annual Report checked 2026-10