4

I am trying to devise a backup strategy for a Windows server, and I'd like it to satisfy the following criteria:

  • It should be resilient to malware: If ransomware takes over the server, it should not be able to destroy the backup.
  • It should be automatic, i.e., it should not rely on people manually attaching and removing USB HDDs.
  • It should be as simple as possible given the two criteria above.

This is what I have already thought of:

  • Automatic nightly backup to some external storage: not malware-resilient. The server needs write access to the storage; thus, the storage can be wiped once the server has been compromised.

  • Automatic nightly backup to rotating USB disks which are stored externally: not automatic, since it depends on humans not forgetting to do that.

  • Automatic nightly backup to rotating USB disks which are switched by a robot: not simple.

  • Automatic nightly backup to the cloud using Azure backup: not malware-resilient.

Another option would be a backup server which pulls backups from the main server, but I guess harding the backup server such that the main server has no access to it (even if the malware gains domain admin access) qualifies as not simple.

Any other option that I've overlooked?

  • If you use a versioned cloud backup, it should be malware resistant - the current version might be junk, but the previous versions should be good. – Matthew Dec 13 '16 at 12:03
  • What about backing up to another server where a script takes copies of the backup file share into another, non-shared directory? If ransomware trashes the file share, the non-shared copies would still be safe unless that backup server is also compromised. – André Borie Dec 13 '16 at 12:19
  • I don't know any available product that does this, but theoretially your remote backup server could deduplicate the backup (always keep old backups) and then make it read-only by revoking writing permissions of the account pushing the backup. – Volker Dec 13 '16 at 13:38
  • I'm not familiar with Azure Backup, but Amazon S3 let's you grant privileges for uploading only. This means that even if the malware would be smart enough to delete cloud backups, the access token granted for the compromised machine will not be allowed to do so. More info: docs.aws.amazon.com/AmazonS3/latest/dev/… – buherator Dec 13 '16 at 13:43
  • WORM tapes in a tape library? – billc.cn Dec 13 '16 at 14:24
1

Apart from the new-ish requirement for malware resistance (specifically ransomware resistance), what you describe is the definition for backups though it is missing the requirement for backups to be in multiple locations.

Backups aren't really Backups unless they are fully automatic. They need to be capable of operating for years without manual intervention.

The malware issue is dealt with in two ways:

  1. Backups need to be versioned so that if one or more files have been encrypted by ransomware, you can reach back in time to a previous version. Of course, the additional requirement is that the backup media itself must either be versioned or immune from ransomware.

  2. Backups must not be susceptible to corruption or deletion by malware (or by anything else for that matter!)

Any decent commercial backup tool will give you all of your requirements. Where things get tricky is where you are trying to shave costs and use semi-pro or consumer level backup tools. In that case, you may need to take some steps for yourself and this appears to be what you are describing here.

An example of a consumer solution that delivers all the requirements of a secure backup service both in the cloud and on private servers is CrashPlan. An example of a client tool that can be used with multiple storage locations is SyncBack Pro. There are many others.

SyncBack Pro can be used with many different storage locations including Amazon, Azure and others but do watch out for the backups becoming susceptible to corruption from malware, don't mix backup locations with file-sync locations for example. It also allows you to keep versioned backups though you have to remember to configure this yourself as it isn't the default.

You should be aiming for at least two different locations for backups no matter what tool you use. Ideally backup locations should not be accessible directly as file-systems as this leaves them vulnerable to a lot more malware.

As an example, for myself and family, I use CrashPlan to backup both to the cloud and to a local NAS. In addition, some critical files are also copied to versioned filing systems, generally both locally (NAS again) and in the cloud.

Bottom line is that, if you value the data, back it up using a recognised, trusted, commercial backup tool to multiple locations which are not accessible as a filing system and make sure the tool lets you keep multiple versions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.