2

I am using Windows 10 with Defender. I follow all the ground rules when dealing with the internet and staying secure. I work in IS so I'm pretty familiar with the various threat-vectors and do a good job at protecting myself from them.

But we all know there is no fool-proof way. Plus, there are other folks that use the family computer so there are a lot of uncontrolled variables.

I have a Debian server at home running NextCloud and hosting a few CIFS/Samba shares. It is backed up, with versions, to a public cloud provider. On my Windows 10 I use the NextCloud client to sync my Documents with my NextCloud server and then I have a few of the CIFS/Samba shares mounted.

If I do get a Ransomware virus I'm not worried about my laptop as long as my Debian server is fine. So I got to thinking how I could protect myself -- particularly the data hosted by the CIFS/Samba shares.

Even if my C: is encrypted, the NextCloud client would sync the encrypted files, not the virus, to my Debian server. And, even if it synced to my server, it would still have to somehow execute. And the files are backed up so I'm safe from this angle.

My worry is that the Ransomware virus will also encrypt my CIFS/Samba share mounts. The only true solution is to either only mount as read-only or not use them.

Am I missing anything and/or some angle I'm not seeing?

Improve this question
1
  • 1
    Perhaps you could add some separation between the versions? E.g. a job on the server copies old backups to a place not accessible/writiable from clients on the share. Or only allow a privileged user on the client to access the share so that ransomware compromise of a normal account won't affect backups.
    – multithr3at3d
    Commented Nov 12, 2018 at 14:02

1 Answer 1

Reset to default
1

One close to fool-proof way to protect yourself from ransomeware is to have regular versioned backups. This way if you lose your data to ransomware, you just have to restore from a backup. I realize that this is sometimes more complicated that just copying over files from a backup, but it will give you a certain amount of pice of mind. After that its really just a matter of limiting access and doing regular updates.

Improve this answer
2
  • Yeah I am working on that now. Trying to find the best way to take regular versioned backups of my 1.5 TB of data. I've been using rclone but need to see if there is a better way.
    – IMTheNachoMan
    Commented Nov 13, 2018 at 15:32
  • yea, I'd use rsync, but rclone might be better for what you're doing.
    – MikeSchem
    Commented Nov 24, 2018 at 1:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .