1

I have a backup drive in my box that I only use to house differential backups of my other drives. I currently don't have the money to buy an external solution, and would like to ensure my backup drive is as safe as possible from things like ransomware.

Is there a way to block write-access to the drive through windows without first requiring some form of additional authentication? Would this even mitigate something like ransomware from encrypting the drive?

  • The question is: What prevents the write access? Is it software? Or rather a hardware based solution? Over a network, this could be simply done by setting proper permissions (and not using the root user), but this is not applicable to your case. The best solution, I guess is to unmount the drive or even better, unplug it completely when not needed. – GiantTree Aug 1 '16 at 1:40
  • Couldn't a person just Devcon the disk or the whole controller device off at the driver/hardware level? Get into the device manager and disable the disk and see how accessable it is then. See also if anything notices it missing and has a fit. If that works make a devcon script toggle that pulls it and puts it back with an icon. test again. I do not think that virus makers and ransomware turns devices back on at the driver level so far, so it should be relativly safe like that until they added that to their evil plans. – Psycogeek Aug 1 '16 at 6:58
1

Assuming that any ransomware is running under your own user-account, because you accidentally downloaded and executed it, or it used a flaw in any software you are running, then you can do the following:

  • Make sure your normal user account is not a member of the administrators group
  • Don't just rely on UAC prompts, don't use an admin account for day to day work.
  • Always keep your Windows OS up to date with the latest patches.
  • Make sure your normal user account is not a member of the administrators group

If you follow this, the ransomware will only be able to encrypt files that you have access to.

On your backup drive, you can give yourself read access but no write access at all to any files. So it's easy for you to get to a backup copy of a file if you need to, but you can not change the file and the ransomware can not encrypt it.

Set the NTFS permissions on your backup drive like this:

 NT AUTHORITY\SYSTEM:(OI)(CI)(F)
 BUILTIN\Administrators:(OI)(CI)(F)
 BUILTIN\Backup Operators:(OI)(CI)(M)
 BUILTIN\Users:(OI)(CI)(RX)
  • Create a new user exclusively used for backing up files and add that account to the Backup Operators group.
  • Setup the software that is responsible for the backup to run under that new account. So the software/script/task can write files to the backup drive.
  • Make sure your backup process doesn't overwrite files on the backup too often. If some ransomware kicks in and encrypts files, you don't want your backup process to copy those encrypted files over to the backup drive too quickly. Having separate folders with differential backups during the day may work.
  • Ideally your backup process would have an option to prevent the copying of encrypted files.
  • Make sure your backup process does not copy NTFS permissions with the files, this would give you and the ransomware write-access to the files again.
  • Make sure that whatever triggers your backup process can not be triggered by your normal user account.

I'm doing this exact same setup for quite a while now, I still do backups to external drives and the cloud, but the most frequent backups are to an internal drive.

This also prevents yourself from accidentally deleting backup files.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.