The 3 2 1 Backup Rule Explained for Small Businesses
The 3 2 1 rule is the simplest way to check whether your backups would really save you. Here is what it means, the modern 3 2 1 1 0 version, and how to apply it to a typical North East business.
Key takeaways
- Traditional antivirus mainly blocks known malicious files; modern attacks often avoid using them at all.
- EDR records and analyses behaviour on each device, so it can spot and stop suspicious activity and help investigate what happened.
- MDR adds a team of people who watch the alerts and respond, which matters if nobody is watching at 2am.
- XDR joins up signals from devices, email, identity and cloud services into one picture.
- Protection only works if it is installed everywhere, kept up to date and someone acts on its alerts.
Most business owners know they need antivirus. Fewer know what EDR, MDR or XDR mean, and the security industry does not make it easy. Vendors use the terms differently, and every product claims to stop everything.
This guide explains the four terms simply, why traditional antivirus struggles against modern ransomware and what a business of 5 to 100 staff should actually look for.
Traditional antivirus: the guard with a list
Traditional antivirus works a bit like a security guard with a list of known troublemakers. Every file on your computer is compared against a database of known malicious files, often called signatures. If there is a match, the file is blocked or quarantined.
This still has value. It stops a large amount of common, known malware. Its weakness is that it mostly recognises things it has seen before. A brand new piece of malware, or a known one that has been slightly altered, may not be on the list. Modern antivirus products add some behaviour checks and cloud lookups, which helps, but the core approach is about recognising bad files.
Why ransomware gets past traditional antivirus
Ransomware is malicious software that encrypts your files and demands payment to unlock them. Many attacks now also steal data first and threaten to publish it. Ransomware is often sold or rented to criminals as a ready made service, known as ransomware as a service, which means attacks are frequent and constantly changing.
A typical attack does not rely on one obviously malicious file. Instead, an attacker might:
- Sign in with a stolen password, or trick someone into opening a file
- Use legitimate tools already built into Windows, such as PowerShell or remote desktop, to look around the network
- Disable security software and delete backups they can reach
- Copy data out of the business
- Only then run the encryption, often out of hours
Because many of these steps use normal administration tools, there may be no unfamiliar file for a signature list to catch. By the time the encryption starts, it is late. This approach is sometimes called "living off the land", and it is exactly what EDR is designed to spot.
EDR: watching behaviour, not just files
EDR stands for endpoint detection and response. An endpoint is any device that connects to your network, such as a laptop, desktop or server.
Rather than just checking files against a list, EDR continuously records what happens on each device: which programs start, what they do, which files they touch and what network connections they make. It then looks for patterns that suggest an attack, such as a word processor launching a command line, a program trying to switch off security tools or large numbers of files being changed very quickly.
When it spots something suspicious, EDR can respond automatically, for example by:
- Stopping the process and quarantining files
- Isolating the device from the network so an attack cannot spread
- In some products, rolling back changes made by the malicious activity
- Alerting your IT provider with a timeline of what happened
That recorded timeline is valuable after the event too. It helps answer the questions that matter in an incident: how did they get in, what did they touch and is it really over?
MDR and XDR explained
MDR: people watching the alerts
MDR stands for managed detection and response. It is not a different kind of software so much as a service: a team of security analysts monitors your EDR alerts, investigates them and takes action, often around the clock. EDR is only as good as the response to its alerts. If an alert fires at 2am on a Sunday and nobody sees it until Monday morning, an attacker has had a long head start. MDR fills that gap.
XDR: joining up the signals
XDR stands for extended detection and response. It takes the EDR idea further by combining information from several sources, such as devices, email, user sign ins, firewalls and cloud services. An unusual sign in, followed by a new inbox rule, followed by a strange process on a laptop might each look minor on their own. Seen together, they tell a clear story.
| What it does | Who acts on it | |
|---|---|---|
| Antivirus | Blocks known malicious files | Mostly automatic |
| EDR | Monitors behaviour on devices, blocks suspicious activity and records a timeline | Automatic, plus your IT team or provider |
| MDR | EDR plus a team of analysts monitoring and responding | A dedicated security team, often around the clock |
| XDR | Detection across devices, email, identity and cloud combined | Your IT team, provider or an MDR service |
What to look for in endpoint protection
For most small businesses, a well managed EDR product on every device is a sensible baseline. When comparing options, or asking your IT provider what you have, check the following.
- Coverage. Is it installed on every laptop, desktop and server, including Macs and that old PC in the corner?
- Behaviour based detection, not just signatures.
- Automatic response, such as isolating a device without waiting for a person.
- Tamper protection, so an attacker cannot simply switch it off.
- Central management, so your IT provider can see the status of every device in one place.
- Who watches the alerts, and what happens outside office hours.
- How it fits with the rest of your security, such as email filtering, multi factor authentication and backups.
No single product stops everything. EDR is one layer, alongside up to date software, MFA, email security, staff awareness and backups you have tested. If ransomware does get through, those backups are what get you working again.
Insurers increasingly ask about this too. Many cyber insurance proposal forms ask whether you use EDR.
How Cyber Fits can help
Cyber Fits uses VIPRE for endpoint protection on the devices we manage for businesses across Sunderland and the North East, as part of a layered approach that also covers updates, email security and backups. If you are not sure what is protecting your computers today, or whether it is installed everywhere it should be, a free IT review will give you a clear answer.
Frequently asked questions
Is antivirus still worth having?
Yes, it still blocks a lot of common malware. But on its own it struggles with modern attacks that use legitimate tools and new or altered malware, which is why many businesses now use EDR, which includes antivirus style protection alongside behaviour monitoring.
What does EDR stand for?
EDR stands for endpoint detection and response. It monitors behaviour on devices such as laptops, desktops and servers, detects suspicious activity, responds automatically and records a timeline that helps investigate what happened.
Do small businesses need MDR?
It depends on who would respond to an alert outside office hours. If nobody would see it until the next working day, an MDR service, where a security team watches and responds around the clock, can close that gap. Your IT provider can explain what cover you currently have.
Is Microsoft Defender enough for a small business?
Microsoft Defender Antivirus is built into Windows and is a reasonable baseline. Microsoft also offers EDR capabilities in some plans, such as Defender for Business in Microsoft 365 Business Premium. What matters most is that protection is on every device, configured properly and that someone acts on the alerts.
Written by the Cyber Fits team
IT support and cyber security, Sunderland
Our guides are written by the team who support businesses across the North East every day. If anything here raises a question about your own setup, ask us.