Does using OneDrive, etc. with versioning for documents provide for fast recovery from Ransomware?

Question

I know there's no 100% in security. But for business users (yes that is a range of use cases), if they are on Windows 10, they have My Documents pointing to a OneDrive (or GDrive, DropBox, Box, etc.) share, and that share has versioning turned on - then would recovering from Ransomware be pretty fast and easy?

In case of Ransomware then just reinstall a clean Windows, point to OneDrive, and for all files, go to the last unencrypted version of the files.

Assuming all other data is hosted (email is hosted Outlook or Google, Salesforce, etc.) then isn't it a quick and easy recovery. For the users (servers is a very different problem).

Or am I missing something?

Note: I am not asking for an opinion here (a no-no on the site). I am asking what specific issues would remain in this situation.

Answer 1

If there is a logical or physical connection (mounted folders/shares, LoginCredentials pointing to OneDrive) then there is a way to reach it. Without going too much into detail about OneDrive, modern Ransomware is usually capable of detecting and using those connections. It can go undetect for months without encrypting anything, rendering older Versions of files useless without you even noticing it. Online Backup (online in the sense of connected to your Domain / Network) doenst help you there. Hence the 3-2-1 backup strategy that is usually recommended. 3 copies of your data on two different media (for example disk and tape) with one copy off-site for disaster recovery. This way the copy offline for disaster recovery has no logical or physical connections to your production enviroment. On a sidenote: Using OneDrive usually requires some kind of ActiveDirectory Sync between local instances and AzureAD. Good luck trying to access your Microsoft Tenant when your whole local AD is encrypted.

Answer 2

It depends on the ransomware. Simpler ones that get all local files and encrypt them can be defeated by versioning, but I've read of some strains that detect cloud backups and delete them too.

would recovering from Ransomware be pretty fast and easy?

Recovering several TB's of data isn't fast nor easy. Even on a 100MBPs network, downloading 10TB of data would take 10 days. And 10 days for recovery isn't something most companies will find acceptable. It's better than losing all data, but isn't even close to ideal.

If all your data is on the cloud, and the malware didn't just wiped it while encrypting the local copies, it can be a little easier, but as malware is evolving, consider the possibility of not being able to count on cloud storage.

That's why you need local, offline backups. A tape drive can be a hefty investment when you buy, but it can decrease recovery times from weeks to hours.

Answer 3

The better to avoid the effects of ransomwares is not use any syncronizer like Dropbox, Drive, Onedrive, etc. They spread the infection. The ransomware encrypt all files that the computer has access. The syncronizer upload the encripted file to the cloud. So the mess is done.

You can use a web solution like Sharepoint, Google Docs, or better SaaS program like Dataprius or Documentum. If a virus attack, It can't access to the files.