Simple, malware-resilient, automatic Windows backup (or: How should the average small company protect their Windows server?)

Question

I am trying to devise a backup strategy for a Windows server, and I'd like it to satisfy the following criteria:

• It should be resilient to malware: If ransomware takes over the server, it should not be able to destroy the backup.
• It should be automatic, i.e., it should not rely on people manually attaching and removing USB HDDs.
• It should be as simple as possible given the two criteria above.

This is what I have already thought of:

• Automatic nightly backup to some external storage: not malware-resilient. The server needs write access to the storage; thus, the storage can be wiped once the server has been compromised.

• Automatic nightly backup to rotating USB disks which are stored externally: not automatic, since it depends on humans not forgetting to do that.

• Automatic nightly backup to rotating USB disks which are switched by a robot: not simple.

• Automatic nightly backup to the cloud using Azure backup: not malware-resilient.

Another option would be a backup server which pulls backups from the main server, but I guess harding the backup server such that the main server has no access to it (even if the malware gains domain admin access) qualifies as not simple.

Any other option that I've overlooked?

Answer 1

Apart from the new-ish requirement for malware resistance (specifically ransomware resistance), what you describe is the definition for backups though it is missing the requirement for backups to be in multiple locations.

Backups aren't really Backups unless they are fully automatic. They need to be capable of operating for years without manual intervention.

The malware issue is dealt with in two ways:

1. Backups need to be versioned so that if one or more files have been encrypted by ransomware, you can reach back in time to a previous version. Of course, the additional requirement is that the backup media itself must either be versioned or immune from ransomware.

2. Backups must not be susceptible to corruption or deletion by malware (or by anything else for that matter!)

Any decent commercial backup tool will give you all of your requirements. Where things get tricky is where you are trying to shave costs and use semi-pro or consumer level backup tools. In that case, you may need to take some steps for yourself and this appears to be what you are describing here.

An example of a consumer solution that delivers all the requirements of a secure backup service both in the cloud and on private servers is CrashPlan. An example of a client tool that can be used with multiple storage locations is SyncBack Pro. There are many others.

SyncBack Pro can be used with many different storage locations including Amazon, Azure and others but do watch out for the backups becoming susceptible to corruption from malware, don't mix backup locations with file-sync locations for example. It also allows you to keep versioned backups though you have to remember to configure this yourself as it isn't the default.

You should be aiming for at least two different locations for backups no matter what tool you use. Ideally backup locations should not be accessible directly as file-systems as this leaves them vulnerable to a lot more malware.

As an example, for myself and family, I use CrashPlan to backup both to the cloud and to a local NAS. In addition, some critical files are also copied to versioned filing systems, generally both locally (NAS again) and in the cloud.

Bottom line is that, if you value the data, back it up using a recognised, trusted, commercial backup tool to multiple locations which are not accessible as a filing system and make sure the tool lets you keep multiple versions.