I got an old computer from some friends, so I decided to wipe it and set it up as a home NAS running Windows 7. My plan is to have two external drives: one as a network-accessible, read/write device for sharing data across my home devices, and the second as a backup drive. I plan to use the built-in Windows 7 backup software to make regular incremental backups from the client-accessible drive to the second drive. I will use the default Windows Homegroup sharing.

My concern is security, specifically with respect to ransomware. I don't plan on sharing the backup drive directly over the network, however I can imagine a scenario where ransomware is brought into the network on a client computer, or even on the NAS itself, by someone using it as a workstation. If the ransomware encrypts the client-accessible drive, no big deal, I have the backup. But how can I guarantee that ransomware, or for that matter any user/program other than Windows Backup, won't be able to encrypt/attack the backup itself?

I found this question, but the answers seem to rely on piece of third-party software or another. I'd like to stick with the built-in features of Windows 7, if possible.

  • You would better off have a service that unmounts the backup drive, so its not accessible to any program, until its needed. The way these randsomeware work today is that they will encrypt drive they can see, once the encryption process is done, they can only decrypt data. I see some flaws with your idea since the drive will still be accessible to a user even if it wasn't the user that was logged into the operating system. – Ramhound Jan 7 '15 at 18:01
  • That's a good point. Automated unmounting sounds like a good idea. But, couldn't one conceive of a ransomware that tries to remount any connected drives? – alexw Jan 7 '15 at 18:32
  • You can't protect against something that doesn't exist. The current randsomeware that exists wouldn't be able to do that. Besides you still need an offsite backup. Trying to understand why some random person would start using your NAS like a workstation though :$ Put the thing in a closet or something :$ – Ramhound Jan 7 '15 at 18:49
  • Well, the plan is to use the machine as a general-purpose downloading/scraping/organizing workstation (which is part of the reason I put Windows on it to begin with). I do use Google Drive + Boxcryptor to backup critical files. But, I have it mounted as a network on one of my computers, which means if it got infected, it could destroy that copy as well. – alexw Jan 7 '15 at 21:40
  • The current randsomeware that exists is extremely easy to avoid, strange USB devices shouldnt be used, but honestly there isn't a good solution outside of the offline backup and not be infected – Ramhound Jan 7 '15 at 22:01

Remove all user permissions from the backup drive except those for the user the backup software runs as.

Since you want to use the Windows Backup service, you'll probably need to create a specific user account for the Windows Backup service to use instead of the default "Local System" account.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.