Timeline for What is a good backup strategy against ransomware?
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 4, 2016 at 14:54 | comment | added | user | The difference is -- and this said with the caveat that I have never suffered from ransomware, nor do I plan to -- that any reasonable ransomware wants to stay undetected for as long as possible, and certainly until it has finished encrypting all your files. Thus it makes sense that it would allow access to the unencrypted content of any encrypted files while the encryption process is running, and re-encrypt any re-saved files immediately. That is relatively easy to do with a file system driver on most OSes. When the infected OS is not running, the ransomware isn't there to do the decryption. | |
| Jun 4, 2016 at 14:49 | comment | added | Ben | @MichaelKjörling as emory points out, like any backup strategy, you'll want to keep some number of old backup images. But I actually think you're more likely to get encrypted files in the backup if you do a live backup, just because it could start encryption while you're in the middle of it. I doubt there is any greater chance of starting tte backup halfway through encryption one way or the other. | |
| Jun 4, 2016 at 14:22 | comment | added | emory | @MichaelKjörling It is obvious - to me at least - that we need multiple backups over time. We can not predict when the ransomware will encrypt the files so we must regularly backup our files and keep old backups. Then if and when the bad thing happens, we can restore the last good backup copy. But it is probable that we will end up backing up some ransomware encrypted files. | |
| Jun 4, 2016 at 13:07 | comment | added | user | If a new backup is taken when the ransomware is almost done encrypting the files, doesn't this have the obvious risk of backing up files that the ransomware has already encrypted? Especially if the backup is taken with the ransomware not running... | |
| Jun 4, 2016 at 2:21 | history | edited | Ben | CC BY-SA 3.0 |
added 42 characters in body
|
| Jun 4, 2016 at 2:20 | comment | added | Ben | If you can back up the system without giving write access to that system (some network-based backup software can do that by pulling data from the system), then go for it. But if you're talking about personal backups of one computer you'd most likely need to connect your backup storage as a writeable filesystem, which risks the ransomware killing your backup. Mounting it read-only could probably be fine, but it would be easy to make a mistake, so personally I would just use the backup disk with the backup software only. | |
| Jun 4, 2016 at 0:53 | comment | added | emory | what is wrong with backing up a live system and what is wrong with connecting your backup read only to a live system? | |
| Jun 3, 2016 at 15:35 | history | edited | Ben | CC BY-SA 3.0 |
typo
|
| Jun 2, 2016 at 15:18 | history | answered | Ben | CC BY-SA 3.0 |