Synology Active Backup vs. Ransomware?

[Gongalong]

Hi folks,

 

I'm looking for a cheap and cheerful solution to backup 365, essentially Teams and OneDrive. Essentially it's for recovery in a disaster situation, such as a ransomware attack.

 

Is anyone out there using a Synology NAS with Active Backup for this? I wanted to be sure it's capable of recovery post-ransomware i.e. it can revert back to an earlier snapshot of a Team and then restore it easily, and/or are there any other gotchas with use.

 

Thanks

[noelmm]

I'd like to know this as well. Ever since we went O365 (moved to SharePoint in September, been OneDrive since January) our local authority no longer backups our data as they say a backup strategy isn't required as we now have access to a recycle bin (I have access to the 2nd stage) and we can restore a document library if needed. As a result I've considered a Synology solution but need to do more research before I justify asking for that type of money if it's not needed.

[supportman]

We are similar but have used both Veeam O365 and Synoilogy.

 

Both work OK but you need to seperate your Sharepoint teams really to not have huge document libraries.

[Gongalong]

We are similar but have used both Veeam O365 and Synoilogy.

 

Both work OK but you need to seperate your Sharepoint teams really to not have huge document libraries.

Are you using Active Backup, and do you think it's ransomware proof e.g. allows you to restore a Team's files back to an earlier point?

[glen_j]

You can restore files to a team from an earlier date. You can Also export the files if needed.

[TechMonkey]

I don't think I am using Active Backup but did turn on the M365 backup solution within Synology. Not used it in anger yet but it looked like it was doing what we needed. I've been of the mind that we didn't need an M365 backup solution but know how it goes so turned it on as belt and braces.

[raygroom]

Been using this to backup O365 locally on a synology 820+ since april this year, can restore from an earlier date. I had to restore some emails from a user that had left and their account had been deleted, worked no problem. I got a loan unit from synology to test it had it on load for 2 months and then bought a different model to the loan unit, synology were really helpful.

[andy_b]

Been using this to backup O365 locally on a synology 820+ since april this year, can restore from an earlier date. I had to restore some emails from a user that had left and their account had been deleted, worked no problem. I got a loan unit from synology to test it had it on load for 2 months and then bought a different model to the loan unit, synology were really helpful.

 

About how many users / GB are you backuping up ?

[raygroom]

Im backing up 60 users and that is taking up about 200GB its mainly email and very small amount of onedrive and sharepoint

[TheRobins]

Hi,

 

Been using a RS1221+ and 8 x 12TB drives with 2 Synology 400GB MVE cache drives (included in the deal)

 

I have set aside 18TB of the array as a secondary VEEAM store and then left the rest for Active O365 backup.

 

We have around 600 users, of which all use Cloud Drive Mapper so all data in O365 and Teams used quite a bit for assignments with OneNote.

 

This has been in since Aug 21 and has ran faultlessly. Not really had to restore anything, just get 2 emails from a member for staff who had left in September. You get the option to configure your backups as you require. So I set all staff and students to be instant backups on their accounts, whilst setting shared sharepoint and teams as a nightly backup. Instant backup I have noticed tends to happen in 5 minute batches which is good enough for our requirements. i have also found it is account aware, so if a user leaves it locks down their account but still allows access according to your data retention.

 

I find the platform good to use and means we are in control of our data, I wanted a NAS for storage of VEEAM backups anyway and just adding the bigger drives gave us this functionality. I would suggest having a good enough connection to support the traffic if going for continuous backup, thankfully on a 1gb line here so never is an issue. You can see orange warnings on the dashboard, this is an error that's bought up when a locked in use file is backed up, Its still backed up but just moans its open and in use so I ignore these.

Edited November 30, 2021 by TheRobins

[Gongalong]

@TheRobins Does it allow you to narrow down to which Teams you want to backup?

[TheRobins]

Certainly can, fully granular down to site and user level.

 

Hard to post without giving away data but yes its possible. However I found this "could" get messy with groups that are added if you do not add them to the list by hand, I have just set all mine to auto and to also accept new users and sites by default.

 

I do also believe, if there is any repetition with jobs, say a user appears in 2 different jobs due to their role it will not store their data again, but de-duplicate it for space. Sadly the backup portal is one of things you cannot test with the online DSM virtualisation, even if you could I wouldn't want a global admin being used on a virtual appliance instance.

 

[Steve101]

Once you've backed up your 365 data on your synology unit does the Antivirus app scan that data? is it useful for protecting against ransomware etc?

[TheRobins]

Once you've backed up your 365 data on your synology unit does the Antivirus app scan that data? is it useful for protecting against ransomware etc?

 

Id say so, yes it does. This is just the free essentials package on the system, no experience of their premium offering.

 

BTW I have checked the files it picks up, they are old flash games used by DT Dept in 2008, really need to start sorting out some of these subject shared areas with leaders of dept.

 

Edited December 1, 2021 by TheRobins

[Gongalong]

@TheRobins Can you encrypt the backups? I'm guessing yes, but just to double check. Thanks

[TheRobins]

Not something I have looked at, main reason being is that the actual Synology itself is encrypted.

[slugshead]

I use active backup for g-suite, not had to restore from it (yet) but there's lots of points to restore from.

[lmrogers]

Is there not still a threat from Ransomeware despite the files being scanned and the Synology or even the backups being encrypted?

 

I'm looking into backing up 365 now and the Synology is definitely what I am looking at but still have concerns that if the school is ever hit with Ransomware it could infect the Synology as it is still connected to the network.

[Steve101]

My understanding of ransomware is that it will usually sit dormant in most cases, until an administrator logs in to a computer and it has the credentials to exploit.

 

Using the backup and antivirus method you should be able to find where it sits should you come to recover your systems. Your backup system is not protection against ransomware.

 

As far the synology box being infected, are these not usually viruses programmed for Windows machines?

[lmrogers]

I guess I'm just thinking real worst case scenario. It's good that it scans the files being backed up. Last thing you would want is a ransomeware file sitting dormant when you use the backup to restore after an attack.

 

I just wonder how far you can mitigate the risks and whether there are other protections that could be put in place alongside it, short of paying out thousands for cloud storage.

 

Also what retention policy are people using? 30 days, 90 days, longer?

[Davit2005]

Just setup Synology at home last night to backup my personal Office365 account. It was easy to a certain extent in that I have all the internet to and from my servers at home tied down, smarthome and wifi are segregated bedind firewall and servers access behind acl rules so had to play with the firewall rules a bit to get it working. I would say not to enable any remote access to the synology NAS unless it is strictly needed and you can install packages manually. You could place the synology behind some sort of proxy too.

 

I'd make sure that the storage where the backups are kept is not shared (no reason to be honest) and permissions are not strayed away from the defaults. You can enable MFA on the Synology so that makes it a bit secure. I'm going to have a bit more of a look into it when I get home. I've tested restore of some emails already which worked well and pretty seamless.