1

The servers at my lab were recently hacked (ransomware attack) and I've been assigned to make our network more secure.

I propose doing weekly backups with an SSD-cached RAID (10-20TB range) that is physically isolated from the network. Every week, I'll go upstairs and manually connect the backup device and run the program (leaning towards rsync on a linux system).

Searching the internet for a while, I've found very little infomation and no products related to this scheme. Hopefully this community can help me by answering these questions.

Can I buy devices that do what I want, or do I have to make them myself?

Is physical isolation overkill? Why is it so rare?

Improve this question
7
  • Devices to do what, exactly? Isolate? Why not mount and unmount via cron?
    – schroeder ♦
    Dec 18, 2018 at 13:22
  • The isolation part is what I'm stuck on. I'm thinking knife switches, or something. But if I can buy something I'd rather do that than break out the soldering kit.
    – psitae
    Dec 18, 2018 at 13:24
  • 1
    Why do you need to physically isolate? Logical isolation works, as does "write only".
    – schroeder ♦
    Dec 18, 2018 at 13:30
  • Ransomware is not particularly advanced. Follow the 3-2-1 backup rule and you'll be fine.
    – forest
    Dec 18, 2018 at 13:33
  • Seems like you're saying physical isolation is overkill. My assumption is that everything is hackable, to some extent. Is a lack of permissions on linux really such a high barrier?
    – psitae
    Dec 18, 2018 at 13:37

1 Answer 1

Reset to default
1

There is no need to use physical isolation for ransomware. All you need to do is set your backup server to accept new data but not overwrite or delete old data. This can be done by correctly configuring rsync, for example, or by using a filesystem with snapshots like ZFS. Ransomware is not particularly sophisticated and is not going to waste a valuable 0day exploit just to bypass Linux access controls.

You can avoid natural damages, such as power surges, by using proper surge protection. If this is not built into your datacenter, you should get surge-protecting equipment to clean the power. Be sure to follow the 3-2-1 rule of backup: 3 copies of the data, 2 onsite with different storage types, and 1 offsite.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .