I have OSX. Time machine takes periodic backups. This backup is encrypted.

If my machine were to be infected and locked by ransomware, what prevents the backup from also being comprised as it is just attached storage? I believe that once decrypted (after prompt) it is just as vulnerable as the main SSD. It could be attached and encrypted without risk.

Other than rotating out a volume periodically (either physically, or cloud), what other methods are employed currently for small businesses if the above is an accurate risk assessment?

  • 1
    What makes you think if it is attached and encrypted there is no risk? If you want backups for ransomware, you never leave them attached, and you test the backups. Otherwise, the ransomware will encrypt the backups too
    – nobody
    Jun 14 at 17:37
  • Ransomware will encrypt the encrypted backups ...
    – schroeder
    Jun 14 at 17:54
  • Tape drives are generally used to make backup which is more secure than backup on SSD/HDD because of air gap.
    – saurabh
    Jun 14 at 20:32
  • @saurabh, isn't the air-gap a result of tape cartridges being cheaper, so it is possible to rotate them less frequently? I guess you can have air-gaps with SSD or HDD too if you really want to.
    – reed
    Jun 14 at 20:39
  • Yes, this is one of the reasons but not the only reason I see. Tape drives has statistically shown to be more reliable than HDD and SSD. Also, you are right SSD or HDD can also be air gaped.
    – saurabh
    Jun 14 at 20:51

Physical separation is how businesses deal with this threat. Unplug or unmount the backups once the backup is complete.


Apart from air-gapping the storage, the simplest approach is to reverse the access policy. This is straightforward to setup on Synology NAS and QNAP devices alike.

The ransomware runs on the PC and has access to its storage. The same access is granted to the backup unit. The PC does not write its files to the backup unit; rather, it is the backup unit that reads the files from the PC through a backup agent (or, at worst, a read-only access to the drive through any network file system available). The PC has a read-only access to the Time Vault storage, and no more.

This means that if a ransomware encrypts my ~/VeryImportantDocument.odt, this will be "seen" by the backup system as "Leonardo has modified ~/VeryImportantDocument.odt", and the next copy that will be taken will be useless to me (being ransomware-encrypted). But I will still be able to restore the version immediately previous to that one. The ransomware will be unable to delete or encrypt those data.

Also, when running the backup, the backup unit makes a plan - it has to, to ensure there is sufficient storage for a consistent snapshot. Since I have confirmed that I never change more than 1% (and that's a gross exaggeration) of my files every day, I have set up things so that as soon as the daily changed files counter goes beyond this limit, a warning is issued.

  • Let's remember that this method only works if the backup server cannot be administered by the infected machines, or if the backup server doesn't get infected in some way as well.
    – reed
    Jun 14 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.