Backup to non-persistent mapped NAS

Question

My backup mechanism until now is a batch file to copy my data folder to my NAS, which is permanently mapped as Drive N:. I have a batch file (BackShut.bat) which mirrors my data directory to the NAS and then shuts the system down; this means I can start the batch file when I finish for the day. I use the program Mirror.exe from Zeno Systems which is freeware (at least it was back in 2009) and it seems to work OK.

Recently I have read some more about ransomware and it seems that this may be inadequate: the ransomware may encrypt the permanently mapped NAS as well as my local hard disk. I use the NAS for other purposes so I want to keep it available. I also use Dropbox but I understand some ransomwares can zap that as well.

So I had the idea of creating another share on my NAS and only mounting it at backup time with a line like:

net use X: \\192.168.1.50\backup /persistent:no

and then backing up to X:

The NAS share backup is public, so no password is needed. Since the system shuts down right after the backup, there is only a small time window when a malware program would have access, and my mail server and browser are not running at that time.

I realise this is not industrial-grade security, but would it protect me against a variant of WannaCry if it infected my system? (I run W10 and have automatic updates enabled.)

Answer 1

The underlying problem is that you are effectively allowing a less critical system to initiate communications to a more critical system when really you want that communication to go the other way.

In other words, switch your backup process from Push to a Pull and ideally add a one-way firewall or firewall rule to protect the backup system.

Current

System --Pushes-Data--> Backup Share

Problem

An attack on the compromised system can pivot to attack the Backup system or damage it from the compromised system.

Suggested

System <--(one-way firewall)<-- Backup Server which does a Pull request.

Advantage

Compromised System, Attacker Pivots ---> XXX Packets Blocked -- (Backups unharmed)

You'll also want to have multiple backups or some kind of content versioning to protect against pulling bad data over good data but this will add a layer of defense between these systems.

Having your backup server only on-line at certain times does reduce the attack surface time-wise but it's even better if the attacker can't send packets to it ever. Maybe both controls would be ideal.