2

Say a ransomware encrypts your database but hides the fact (by secretly decrypting everything you ask for). Then your backups become rubbish once the attacker deletes the key.

What are good measures against that?

I wonder if you e.g. should put a backup on a separate disk/tape and analyse it on a computer not connected to your network. By "analyse" I mean run a set of standard tests that show that the data is readable.

Improve this question
6
  • See security.stackexchange.com/questions/222082/… for a related question as it pertains to keeping backups protected from malware and ransomware.
    – mti2935
    Feb 4 at 20:46
  • In addition to the mentioned answer: backing up to write only/write once (e.g. BluRay) storage will work as well.
    – Artem S. Tashkinov
    Feb 4 at 22:12
  • @ArtemS.Tashkinov that doesn't protect against encrypted data being saved to the worm drive.
    – schroeder ♦
    Feb 5 at 1:11
  • @mti2935 the question appears to be about what to do when encrypted data gets backed up.
    – schroeder ♦
    Feb 5 at 1:13
  • @schroeder Yes. If encrypted data gets backed up, then the thing to do is to recover the latest version of the pre-infected files from the backup server. This is possible if the backup server makes incremental or differential backups. The page that I linked to has more info on this.
    – mti2935
    Feb 5 at 3:09

1 Answer 1

Reset to default
2

One of the standard protections is to test the backups. If they are encrypted, all tests will fail. This can be done manually on a schedule, or backups software can run tests automatically at the point of backup. Some orgs run automated test restores of the data once it is backed up (a resource-intensive option).

If encrypted data is backed up, you would know straight away.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .