Defensive › Module 9 › Lesson 1
Backup 3-2-1
Three copies, two media, one offsite — backup rule for YOUR lab data only.
Visual · t16_backup_321
3-2-1 = backup resilience pattern. Original Cyberlium.
Opening
Logs and configs you cannot restore are evidence you never had.
3-2-1 rule: three copies of data, on two different media, one offsite (or offline). Apply to $LAB notes, VM snapshots, and config exports — not exfil of stranger data 'for backup practice.' Defenders test restores; attackers rely on missing backups. Learn what to backup (OS, app data, configs, central logs) and encryption at rest for offsite copies you control.
1. 3-2-1 explained
Production copy + local backup + offsite/offline copy. Different media reduces single failure.
Offsite can be encrypted cloud bucket you own — not public paste.
Command guide
Try these commands — 3-2-1 explained
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-34 — https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
df -h | head -15
du -sh "$HOME/cyberlium-lab"/t16-defense 2>/dev/null || du -sh "$HOME"
find "$HOME/cyberlium-lab/t16-defense" -type f 2>/dev/null | head -20
python3 -c "import shutil; print('disk_free_gb', round(shutil.disk_usage('.').free/1e9,2))"Primary tools to practice this lesson: python3. Reference sites: NIST SP 800-34 (https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. What to backup on $LAB
VM snapshots, $HOME/cyberlium-lab notes, collector configs, policy files.
Document backup schedule in mini-policy.
3. Boundary
Backup only data you own. No copying classmate or employer datasets.
Encrypt backups; chmod 600 keys in lab.
4. What you ship: 3-2-1 applied to $LAB
3-2-1 paragraph + list what you backup + encryption note.
5. What you record before the next lesson
3-2-1 application notes.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Backup roommate drive 'for resilience practice.'
Right
Explain 3-2-1. Next: restore test.
Mission: 3-2-1 mapping
1) Map 3-2-1 to your $LAB files. 2) Name two media types you use. 3) Write NEVER backup stranger data.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Snapshot vs file backup?”
Knowledge Check
APPLY: 3-2-1 means:
Multiple choice
Knowledge Check
APPLY: True or False: Backup stranger data is lab.
True or False
Knowledge Check
APPLY: Offsite backup should be:
Multiple choice