How to Protect Cloud Storage and Backups from Ransomware
Hi everyone. Leo Notenboom here for askleo.com. In previous articles and videos I often talk about
ransomware as really being nothing special. By that I mean it is just malware and you protect
yourself from ransomware the same way you protect yourself from any malware. The goal is to never
ever let it on your machine. If you never let it on your machine,
be it run-of-the-mill malware, or a specific kind of ransomware it's not an issue. However
I understand the fear and I understand that ransomware specifically is one of
the more destructive forms of malware that we've encountered in recent years.
With that in mind there are a couple of approaches that are worth considering to further protect
your data should you ever allow malware known as ransomware to be on your machine. Protecting your
backups is always tricky. More and more malware seems to be reaching out to your external drives
and encrypting the backups that you've been dutifully making to protect yourself.
Not all ransomware does this and I still strongly recommend leaving your backup drive
attached so that your backups can continue to happen automatically. If you do nothing else,
perhaps make a copy of one of those backup images every so often to a drive that you take
offline. However if you're using Macrium Reflect, particularly the paid version of Macrium Reflect,
they recently implemented a new feature called Image Guardian. When that's enabled what it does
is it after making a backup, after creating a backup image on your external hard drive,
it actually sets the Windows file permissions on that file so that nobody can play with it.
Even the administrator can't necessarily play with the file without first changing the permissions.
Certainly you and I even though we might consider ourselves the owner of the file can't just reach
out and delete, for example, one of our images. This is perfect protection against ransomware.
If ransomware does get on your machine backups protected with Image Guardian are not going to get
encrypted. Which means they can then later be used to restore your data to its pre-infection state.
Now I did say of course that you can't delete the files. You can't delete the files using Windows
explorer. You can of course completely manage your backup images using Macrium Reflect’s user
interface. I find this feature compelling and tips the scales in an otherwise neck and neck
race between EaseUs Todo and Macrium Reflect. It's a great feature and I strongly suggest
that if you have Macrium Reflect you consider enabling it. If you don't have Macrium Reflect
look to your backup software. I fully expect this kind of protection to begin appearing in other
backup tools over time. I’ve heard of at least one other, not one I have direct experience with,
but it is such a prevalent issue and something that backup software manufacturers can use
to help protect against ransomware that I strongly expect to see it appearing in more different
backup tools over time. The other concern that a lot of people express is, well, what about my
cloud storage? Here. I’ve got all of my files in cloud storage on my PC as soon as I make a change
that change gets replicated to the cloud and then automatically copied to all my other machines.
Is ransomware going to change the file and cause the newly encrypted file to be replicated to the
cloud and to all my other machines? Yes. However as it turns out both OneDrive and Dropbox have a
couple of very interesting features that will help you recover should it ever happen to you.
The simple approach of course is that each now has a recycle bin.
Which means that when a file changes you'll find the old version of that file in the recycle bin.
More interestingly though they have features that allow you to revert files enmass.
By that I mean and in fact I think it's OneDrive that will actually tell you: hey I just noticed
that you changed a lot of files… was that on purpose? Because what they can then allow you
to do is say: you know what, I didn't mean to do that. Ransomware changed all those files. Please
restore my OneDrive account to the state it was in a week ago. And now all of a sudden all of your
files are returned in their non-encrypted state. Now of course it's important to do this only after
you've removed the ransomware from your machine so that they don't end up getting encrypted again.
It's also important to do this before the files age out of your recycle bin online,
usually that's about a month, which is usually more than enough time to scramble and repair the
damage done by ransomware. But it's important to be aware of both OneDrive and Dropbox have
these additional features that will allow you to recover the files that they have held for you
should they become encrypted by ransomware. The biggest takeaway of course is to not let your
guard down. The best recovery is not needing to recover at all. The best solution is prevention.
Make sure your anti-malware tools are running, they're up to date, and they're doing all the
things they should be doing. However in the case that ransomware does make it onto your machine
consider looking to backup software to protect the backups that they're making. And consider using
cloud storage specifically OneDrive and Dropbox because of the recovery mechanisms
that they provide that could also allow you to recover without needing to pay the ransom.
For updates, for links, for comments and more visit askleo.com/88362.
I’m Leo Notenboom. This is askleo.com. Thanks for watching.