1

My backup mechanism until now is a batch file to copy my data folder to my NAS, which is permanently mapped as Drive N:. I have a batch file (BackShut.bat) which mirrors my data directory to the NAS and then shuts the system down; this means I can start the batch file when I finish for the day. I use the program Mirror.exe from Zeno Systems which is freeware (at least it was back in 2009) and it seems to work OK.

Recently I have read some more about ransomware and it seems that this may be inadequate: the ransomware may encrypt the permanently mapped NAS as well as my local hard disk. I use the NAS for other purposes so I want to keep it available. I also use Dropbox but I understand some ransomwares can zap that as well.

So I had the idea of creating another share on my NAS and only mounting it at backup time with a line like:

net use X: \\192.168.1.50\backup /persistent:no

and then backing up to X:

The NAS share backup is public, so no password is needed. Since the system shuts down right after the backup, there is only a small time window when a malware program would have access, and my mail server and browser are not running at that time.

I realise this is not industrial-grade security, but would it protect me against a variant of WannaCry if it infected my system? (I run W10 and have automatic updates enabled.)

1

The underlying problem is that you are effectively allowing a less critical system to initiate communications to a more critical system when really you want that communication to go the other way.

In other words, switch your backup process from Push to a Pull and ideally add a one-way firewall or firewall rule to protect the backup system.

Current

System --Pushes-Data--> Backup Share

Problem

An attack on the compromised system can pivot to attack the Backup system or damage it from the compromised system.

Suggested

System <--(one-way firewall)<-- Backup Server which does a Pull request.

Advantage

Compromised System, Attacker Pivots ---> XXX Packets Blocked -- (Backups unharmed)

You'll also want to have multiple backups or some kind of content versioning to protect against pulling bad data over good data but this will add a layer of defense between these systems.

Having your backup server only on-line at certain times does reduce the attack surface time-wise but it's even better if the attacker can't send packets to it ever. Maybe both controls would be ideal.

  • Thanks @Trey for clarifying my thinking about initiation and Push/Pull (this is heavy stuff for me!) Unfortunately my NAS doesn't seem to support Pull (I'm still searching). I adapted my backup for (simple) content versioning (great idea!) and distributed it over two physical drives. One thing which bothers me: if the NAS has Pull capabilities, doesn't that make me more vulnerable to data theft? Or is there always a conflict between data destruction and theft? – NL_Derek May 20 '17 at 21:55
  • If you have another computer on your internal network it can mount the share and do the pull for you. – Trey Blalock May 20 '17 at 22:14
  • There is not always a conflict between data destruction and theft but if you didn't design your network with your security needs in mind retrofitting it can be an expense. – Trey Blalock May 20 '17 at 22:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.