Defensive › Module 9 › Lesson 1
Backup 3-2-1
Three copies, two media, one offsite — backup rule for YOUR lab data only.
Visual · t16_backup_321
3-2-1 = backup resilience pattern. Original Cyberlium.
Opening
Logs and configs you cannot restore are evidence you never had.
3-2-1 rule: three copies of data, on two different media, one offsite (or offline). Apply to $LAB notes, VM snapshots, and config exports — not exfil of stranger data 'for backup practice.' Defenders test restores; attackers rely on missing backups. Learn what to backup (OS, app data, configs, central logs) and encryption at rest for offsite copies you control.
1. 3-2-1 explained
Production copy + local backup + offsite/offline copy. Different media reduces single failure.
Offsite can be encrypted cloud bucket you own — not public paste.
Command guide
Try these commands — 3-2-1 explained
═══ LINUX / KALI (Penetration Testing & Service Audit) ═══
Port scan and service banner grabbing against authorized target
Command — copy this
nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}Enumerate web directories and hidden endpoints
Command — copy this
gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hostsMetasploit framework module inspection (Safe lab syntax)
Command — copy this
msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"
═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings
Command — copy this
netstat -ano | findstr /i "LISTENING"
Primary tools to practice this lesson: python3. Reference sites: NIST SP 800-34 (https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. What to backup on $LAB
VM snapshots, $HOME/cyberlium-lab notes, collector configs, policy files.
Document backup schedule in mini-policy.
3. Boundary
Backup only data you own. No copying classmate or employer datasets.
Encrypt backups; chmod 600 keys in lab.
4. What you ship: 3-2-1 applied to $LAB
3-2-1 paragraph + list what you backup + encryption note.
5. What you record before the next lesson
3-2-1 application notes.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Backup roommate drive 'for resilience practice.'
Right
Explain 3-2-1. Next: restore test.
Mission: 3-2-1 mapping
1) Map 3-2-1 to your $LAB files. 2) Name two media types you use. 3) Write NEVER backup stranger data.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Snapshot vs file backup?”
Knowledge Check
APPLY: 3-2-1 means:
Multiple choice
Knowledge Check
APPLY: True or False: Backup stranger data is lab.
True or False
Knowledge Check
APPLY: Offsite backup should be:
Multiple choice