Training module
Updates and backups
Why patching closes known holes, how the 3-2-1 backup rule works and why an untested backup is only a hope.
What you will be able to do
- Explain why most attacks use flaws that already have a fix.
- Set up a backup that survives theft, fire and ransomware.
- Test a restore.
Why updates matter
When a vendor fixes a flaw, the fix also tells everyone where the flaw was. Attackers study new patches and scan for devices that have not applied them. Public catalogues such as CISA's Known Exploited Vulnerabilities list flaws that are being used in real attacks. Automatic updates turn the delay, which is the attacker's window, into a matter of days.
- Turn on automatic updates for the operating system, browser and phone.
- Replace devices and software that no longer receive security updates.
- Do not forget routers, printers and other small devices; they too run software.
Why backups are the real answer to ransomware
Ransomware encrypts files and demands payment. With a recent, separate backup you can restore and decline. Without one, the only options are paying, which guarantees nothing, or losing the data. A backup is also the answer to a lost phone, a failed disk and a deleted folder.
The 3-2-1 rule
Keep three copies of what matters, on two different kinds of storage, with one copy kept away from the original. The copy that is away should not stay permanently connected, because ransomware encrypts whatever it can reach, including a connected backup drive and synchronised cloud folders.
Sync is not backup
A service that mirrors a folder to the cloud also mirrors your deletions and any encryption of the files. Prefer a service or setting that keeps older versions, and know how long it keeps them.
Test the restore
Once, restore a few files to a different place and open them. Many people find out at the worst moment that the backup was empty, incomplete or protected by a password they did not record.
Key points
- Patch quickly, replace what no longer gets patches.
- 3-2-1, with one copy offline or versioned.
- A backup you have not restored is a hope.
Check yourself
Choose an answer to see the explanation. You can start again at any time.
1. What does the 3-2-1 rule ask for?
The point is independence: one event should not destroy every copy.
2. Your documents folder syncs to the cloud. Ransomware encrypts it on your laptop. What usually happens?
Sync copies changes. Version history, where it exists, is what lets you go back.
3. When is a backup proven to work?
Only a test restore shows that the data is complete and that you hold the key.
Go further
Sources
This section is for defence and learning. Do not test systems you do not own or have written permission to test: unlawful access to an information system is an offence (Turkish Penal Code, Article 243).