Ransomware does not stop at the live data. The NCSC has watched it encrypt the connected USB drives and network shares, and compromise cloud backups. The familiar 3-2-1 rule says nothing about any copy being offline. Three copies, two devices, one offsite can all stay reachable, and one incident can take the lot. At least one copy needs to be offline or digitally disconnected when idle. Create-only access on cloud storage gives the write-once effect: ransomware can add a backup but not overwrite the old ones. Rule four gets the least attention: back up often, test the restores. https://www.ncsc.gov.uk/blog-post/offline-backups-in-an-online-world #CyberSecurity #InfoSec #Ransomware