Will this Setup Protect My Data Files from Malware (e.g. Ransomware)?

Question

I set up an external drive for data backup (an SD card inside my laptop card slot). In addition, I connect with a cloud drive for offsite backup (an app that I run only when syncing files).

I always sign in and use my laptop as a 'standard' user. My external drive is set for UAC 'read' privilege only.

I then set my data sync app to run as admin only - meaning I need to type in the admin password before data can be synced to my external drive and to the cloud.

Of course I will remain vigilant about keeping OS and apps updated and avoid clicking email links or downloading unsolicited payloads,etc. -- but in case I miss something and a ransomware comes through, will my Win 10 system stop that ransomware from encrypting my external drive?

Answer 1

TL;DR: I'd suggest you to alternate two SDs, to enable Windows Defender Ransomware Protection and to consider switching to incremental backups.

Your Weaknesses

Your setup is better than the default one, but it seems to have a couple of weaknesses:

1. You might inadvertently synchronize partially encrypted files, propagating the encryption to all media
2. Depending on how your synchronization app works, attackers who compromised your cloud drive might encrypt it and wait for the encryption to propagate locally
3. Local malware might escalate privileges to local administrator bypassing UAC, proceeding to both harvest cloud credentials and then to encrypt local disks

Proposed solution

The key to protecting from ransomware is making valuable backups inaccessible from the potentially infected host. That can be achieved by alternating backup media, or by having a different host access your host and pull the files. You can alternate a couple of SDs (I always keep one encrypted backup in my wallet), or simulate alternating media by having your administrative APP do incremental backups (though that remains exposed to privilege escalation).

Mind some advanced manual ransomware attacks of the past were known to start by encrypting backups, patiently waiting for months for all copies to be overwritten. Only then they proceeded to encrypt the actual data and ask for the ransom. One assumption of IT security is: "the attacker knows your system".

Modern anti-malware software also helps, as it usually includes shadow backup solutions and behavioral analysis detecting and stopping ransomware, but it is not a silver bullet, also because it is subject to the aforementioned privileged malware. In any case activate Windows Defender Ransomware Protection.

Balance the cost

As usual the key point is: how much security is enough? Just enough. If you don't have very valuable data, don't look for the full mitigation, as costs increase exponentially (also in terms of time) but security increases asymptotically.

Additional risks

By backing up unencrypted files to media or the cloud you expose yourself to data leakage. I strongly suggest encrypting backups.

Answer 2

Per your description, so far you've only configured a backup routine for your data, however if a ransomware (e.g WannaCry) affects your computer, it can still encrypts the data in it, and this includes an external drive that is mounted and accessible by Windows.

The described backup procedure has no correlation with a protection layer (antivirus of some kind) against a malicious software with capabilities to encrypt data in your computer. Once the computer is formatted, you will be able to recover the data previously stored in the backups.

Notice that if you willingly install and run a malware in your computer, there is no layer of defense against it.

It seems you are confusing some technical aspects of how a ransomware works, therefore I recommend you to read the following:

• WannaCry ransomware attack
• How to Accidentally Stop a Global Cyber Attacks