[SUGGESTION / DISCUSSION] Locky prevention for network attached backups
Dear Acronis team, dear community,
while Locky and other threats are not declining me and my gf discussed methods how to ensure safety of our local centralized backups and data. I think for the data we cannot do much without suffering usability, but for the backups, my idea was, it would be great if one could assign Acronis to a different user (context). Means: Currently Acronis - by default - does use the same user account and rights to write data on a network location as assigned during the backup creation process. Yet mostly for simplicity a user would use the same user remotely as he uses locally, so he can also easily browse the tib files.
Granted this would be a method for more advanced users (else you could make the process more transparent) but It would be nice if Acronis would not by default use the same user permissions to write on an SMB share as the current user.
This would be a good way to add more security to the backup files, that could be saved in a complete different user (rights) context and prevent that a potential Locky infection will also lock down the tib files the current user has access to.
I know this might be a bit hard to handle for a dev (and a user) especially as this would mean that a new user has to be created and granted NTFS rights on the remote SMB, but perhaps there is a different and yet easier method that did not come into my mind yet.
What would be your ideas to prevent that a Locky infection could harm the backup files, except "hardcore" disconnecting the remote storage?
I know it is a bit lazy but in reality the idea of a scheduled backup and a manually offline / online storage doesn't work well together, I hope you get my idea.
I hear you Karl! I have been advocating improved credential handling myself and I agree it is not an easy thing to implement from a usability perspective.
I think thogh that users are going to have to go through a rather large learning curve with this though as the solutions are going to demand it. Windows 10 itself is making that fact a reality so we'll see where it all leads. Right now from my perspective the vision ahead in this security issue is quite cloudy!
Dear Steve, could you elaborate further how you setup your backup?
I am not sure if I really understood you correctly. So you have setup a seperate user on the Synology that is just used for Acronis backups, in my case this would be a Windows user on my Windows based "NAS".
Other than me you do not map the target actively but manage everything in Acronis only, so using a UNC path instead and using the way to sae credential in Acronis only instead of saving them in Windows, is this correct?
Hello again,
I think with help of Steve I figured out a best practice for my backups.
This is how I think I made my backups more safe against Locky or other attacks:
- created a new user "Backup" on my remote Windows computer "NAS" that holds the backup files (SMB)
- this user has a high-secure password, yet not expiring and non changeable*
- put that User in the Group "Guests" of "NAS" and also the group "Backup-Operators"
- fortified the external HDD (backup target) my user and the user account of my gf does only have read permissions on the SMB share and NTFS. Aswell as only permitting the local admin of the "NAS" to have only read NTFS permissions. So in the more unlikely case that the active user where the external HDD is attached to, no Locky or other virus would have write permissions on the tib files, even though the HDD is actively and permanently attached.
- I have deleted the registry keys HKCU\Software\Acronis\Connections on the computers that previously used a SMB drive to store backups, as otherwise a change of credentials is not possible as long the credentials basically aren't removed completely but limited, like in this case.
- Adjusted the backup target of the backup jobs from a SMB drive to a UNC folder, where only the user "Backup" has read and write permissions on the share permission and NTFS permission.
- Tested that the fortification, so the fact the no other user but the "backup" user can actively write on the external HDD.
- Tested that all other users have read permissions via the SMB share so they could access / browse / restore the tib files if needed without using the Acronis backups.
Thanks again to Steve for this - quite obvious but I think also most effective - hint.
*there is one weakness imho, if a Locky virus would be smart enough to use logged on user being in the Group Administrators, and a script (while tampering UAC) would remove the password security rules of the User Backup and set and own password, but lets hope they are not getting this far, that they start manipulate user accounts to gain more rights...
Hi Karl, glad you have found a way to do this for yourself.
With my setup, I have an 'Acronis' specific account which is created on the NAS with full privileges to access the Backup folders used for my Acronis images.
On the Windows machines there is no matching user profile as this is not needed as I have no shares mapped to the NAS and none of my Windows Users have accounts that match those on the NAS.
The only place where the 'Acronis' profile is known is in the connection information for the specific backup tasks that are pointed at the NAS Backups folder for that particular system.
I can connect to the NAS via Windows Explorer should that be needed but never allow the NAS credentials for doing so to be stored in Windows. The aim being to maintain a high degree of isolation between the NAS and my Windows systems as I was concerned that having permanent mapped shares would leave these open to attack by any malware that might ever get on my machines.
Second that. Thanks again. Hope it may raise some awareness and being of help for other readers, too.