Backups - how are you protecting yours from ransomeware?

[pooley]

As title, looking at securing our backups (primary school), not here every day so can't hot swap dives.

 

So what are people going back to tape? Moving to online (off site), hybrid of everything?

 

Thanks

 

Si

[Joanne]

just make sure that your ntfs permissions are all correct. I got hit in Jan and it used an account that didn't have access to all the things, so backups were fine. However, I also have Redstor and do a monthly backup to a HDD which goes in a safe.

[Fazza]

We use SCDPM to disk and to tape. As the partitions on the disks are not mounted by the OS as such they are (currently) not susceptible to Ransomware-and-the-like.

 

If you're not onsite everyday you could remote in and unmount the drive to prevent it from being ransomwared (if that's such a word).

[Joanne]

Yeah my daily backup drive isn't mapped to the server... it's set up as a virtual hard drive and linked in disk management... I wonder if that is another layer or not?

[Rob_D]

We do weekly backups to an external HDD that goes in a fireproof safe.

[ColinP]

our veeam server is connected by crossover cable to a nas - so the nas can only be accessed from that machine

[psydii]

Decent NTFS / user account separation. (As above)

 

+Tape

 

Removable disks aren't viable for backups that are 10's of terabytes.

[Rob_D]

Aren't the newer ransomwares able to bypass permissions? (not that having good ntfs permissions isn't something we should be doing anyway)

 

The only truly safe storage is the one that's unplugged and turned off.

[FragglePete]

Tape. Just like the fact it's offline. We currently copy to local disk of the backup server, this gets copied to tape and also copied to a NAS box elsewhere. Some sort of script that enables and disables the shares on the NAS box could be useful at an interval (or a command sent from the backup software) ? Looking into it.

 

Pete

[3s-gtech]

NASs secured with AD groups, with the only user having read/write access to them being the account that backups run with (which isn't in general use, obviously).

Backups are retained over a long time to prevent gradual poisoning. Plus, users don't have read/write access to shadow copies (they need me to restore them) and their accounts cannot delete or change these.

Shadow copies write to a separate drive on the storage servers so that heavy writes don't cause older versions to be lost.

Firmware of NASs kept updated to protect from flaws that can exploit them (like POODLE).

[TwistedHelixis]

All my primary schools use redstor for off site backup. Windows backup is used for backing up hyper-v vm's, which goes to an iSCSI server and each week I switch over a USB drive attached to the ISCSI which takes a copy of the backed up vms for me to put in a safe. Apart from the redstor product the rest is part of Windows server so no extra costs.

[Jaan]

We use Veeam with a dedicated system account that has write access. (Domain admins can only read)

 

We back up as follows;

 

Live data to SAN via Veeam everyday. 12:00pm and 6.00pm

SAN replicated to NAS "other building" via Veeam (as above)

SAN to tape offsite\offline every friday

 

So we have d2d2d2tape lol

Edited May 16, 2017 by Jaan

[Blue_Cookeh]

All my primary schools use redstor for off site backup. Windows backup is used for backing up hyper-v vm's, which goes to an iSCSI server and each week I switch over a USB drive attached to the ISCSI which takes a copy of the backed up vms for me to put in a safe. Apart from the redstor product the rest is part of Windows server so no extra costs.

 

Any chance you could let us know how much Redstor is costing you guys?

[AlanD]

I was told - at a meeting about data security (one of the most unsettling meetings I have ever attended) - that many of these malware programs are increasingly sophisticated. They delete or break recovery partitions, they corrupt restore images, they know how to lie dormant, spread and find any online backups connected via shares or on connected servers. Only putting your hand on Off line backups are going to get you back up and running after a serious outbreak

was the message we were encouraged to take away. I think Microsoft will help you - for a charge of course - to get back emails and Onedrive material if you use Office 365. Not sure about google. In many ways the WannaCrypt outbreak has been a lucky escape and a good warning for everyone to get smart. Although we use D2D2T I've always been a fan of windows backup which may not be pretty but functionally its all there - for no cost. And using it to backup to a rotation of large capacity USB 3 drives is so easy no one has an excuse not have backups.

[3s-gtech]

Agreed, Windows Server Backup is a surprisingly capable product, especially with its Exchange and Hyper-V aware components. We use it connected to iSCSI LUNs to get around the limitations of WSB not working with UNC paths. Nice fat and fast NAS on the other end.

[DrCheese]

I backup to a Windows 2016 server that's off the domain running Veeam - Then weekly veeam archives them off to tape. It's worked well so far, but I'm looking at putting dailies on tape as well.

[ITGURU]

Agreed, Windows Server Backup is a surprisingly capable product, especially with its Exchange and Hyper-V aware components. We use it connected to iSCSI LUNs to get around the limitations of WSB not working with UNC paths. Nice fat and fast NAS on the other end.

 

I back up to UNC paths without any problems.

[ITGURU]

I'm still using Tape backup 13 years on! The most protected way that backups can be stored if the system is compromised and needs restoring. Full daily backups.

[Joanne]

I back up to UNC paths without any problems.

 

I could never get it backed up to UNC, so I used VHD instead. I have to reconnect it everytime I reboot, but that's fine.

[TwistedHelixis]

I back up to UNC paths without any problems.

 

There was an issue using this but I cant remember what it was. Might have been that it can only do full backups rather than incremental or speed issues or something like that.

[PotNoodleTech]

This is a great thread.

 

As a result of reading all the above, I'm thinking of removing my Veeam server from the domain, and putting my secondary target NAS on a separate Vlan with fixed IP addresses that only the Veeam Box can see. Will make a couple changes to service accounts and permissions too I think.

 

Cheers!

[3s-gtech]

For me, WSB would not see a UNC path as a destination.