Most data protection guides focus on the same reflexes: strong password, up-to-date antivirus, regular backups. These basics remain valid for protecting your computer data on a daily basis. But they leave a major blind spot: what happens if it’s the administrator account of your backup solution that is compromised, and not just a file accidentally deleted?
Compromised Backups: The Scenario That Rule 3-2-1 Alone Does Not Cover
The 3-2-1 rule (three copies, two different media, one off-site copy) is a standard repeated everywhere. It protects against hardware failure and accidental deletion. It does not protect against an attacker taking control of the backup software itself.
Recent expert feedback on ransomware shows a change in tactics. Attackers primarily target backup administration consoles before encrypting production data. If the cloud or backup software admin account is not protected by separate multi-factor authentication, all backup copies can be destroyed in a single operation.
Recent ransomware response guides emphasize two points that public advice almost always overlooks:
- Backups must be isolated from the main network, not just stored on a permanently connected external drive or an automatically synchronized cloud folder.
- A backup that has never been tested for full restoration is worthless. Regularly restoring a set of files on a separate workstation allows you to verify that the data is usable.
- The backup administration account must have its own MFA, separate from that used for regular user accounts, so that a compromise of one does not grant access to the other.
This model is sometimes referred to as the 3-2-1-1-0 rule: one offline copy, zero errors during the last restoration test. It is a direct complement to the classic rule, not a replacement.
Specialized resources like Secret Informatique detail these backup security approaches tailored for individuals and small organizations, beyond generic advice.
Multi-Factor Authentication: Why SMS Is No Longer Enough
Enabling two-factor authentication remains one of the most effective actions to secure your online accounts. However, not all authentication factors are created equal.
The CNIL now considers SMS OTP as a factor of low robustness. SMS can be intercepted through line hijacking (SIM swapping) or by spyware installed on the phone. This finding pushes towards more phishing-resistant solutions.
| MFA Method | Phishing Resistance | Everyday Practicality |
|---|---|---|
| SMS / OTP | Low (interceptable) | Very simple, no software required |
| Authentication App (TOTP) | Medium (time-limited code) | Requires an app on smartphone |
| Physical Security Key / Passkey | High (domain-bound) | Requires a compatible device |
Passkeys, adopted by an increasing number of services, tie authentication to the exact domain of the site. A fake phishing site cannot intercept the validation. To protect your personal data, migrating to an authentication app or passkey significantly reduces the risk compared to SMS alone.
Digital Subcontracting Chain: An Invisible Risk for Personal Data
When you entrust your files to a cloud service, you are not only dealing with the software publisher. Behind it are hosts, maintenance providers, and sometimes subcontractors of subcontractors. Each represents a potential entry point.
The NIS2 directive, currently being transposed in France, expands this responsibility. Security requirements now extend to the entire digital subcontracting chain, not just the tool you are using directly. For an individual, this translates into a simple question: does your cloud backup provider publish information about its own providers and the security measures applied to your data?
Few consumer services communicate clearly on this point. Checking your cloud provider’s privacy policy and security certifications (server location, encryption at rest, third-party access management) helps assess whether your files are truly protected or simply stored.
Updates and Network Hygiene: Non-Negotiable Actions
Some data security reflexes remain highly relevant, provided they are applied rigorously and not just known.
Automating operating system and application updates eliminates the main attack vector exploited by malware: known but unpatched vulnerabilities. An up-to-date device closes the majority of entry points used by ransomware.
On the network side, your home Wi-Fi connection deserves as much attention as online accounts. Changing the default router password, disabling WPS, and ensuring that WPA3 encryption (or at least WPA2) is active prevents a neighbor or passerby from accessing your traffic.
For connections outside the home, a VPN encrypts exchanges on public networks. It is not a miracle solution against all risks, but a VPN prevents the interception of data in transit over open Wi-Fi.
Protecting your computer data on a daily basis no longer relies on a list of ten simple actions applied once. The reliability of a backup is measured by its ability to withstand the compromise of the account that manages it, not just by the existence of a copy. Testing restoration, isolating critical copies, and adopting phishing-resistant authentication are the three measures whose real impact far exceeds that of a more complex password alone.
