Q: Security of Acronis backups
Hello,
I have a question about some security options in ATI 2017. I don't own the product yet, but in our company we are considering of buying it. But before we buy it I would like to clear out some things.
We will be using Acroins to backup 2 or 3 computers to Synology NAS. Since there is a lot of trouble with crypto ransomware I would like to know if setting password protection on backup would protect the tib files from virus which will try to encrypt it(if somehow can access the files)?
The other thing I would like to know is if it is possible to create backup with no tib files. What i wouild like to have is browsable backup folder with same folder tree as source not compressed tib file.
Thanks for your answers. If the questuions have been answered in some other threads pls point me to it.
So then our backups are safe :)
What if I use ISCI on NAS? Does this still cause problems with connecting?
Have not seen anyone post on that and I have not tried it myself. My opinion however is that ISCI would work fine. I can say that network SAMBA shares work fine.
So then our backups are safe :)
No, not guaranteed. Password protection means that you cannot open the backup archive files using the normal methods that Acronis provides either via the application or through Windows integration unless you provide the password. This does not prevent an encryption virus from encrypting the backup .TIB file if this is accessible to the virus.
This is one reason why I will never assign Windows drive letters to my Synology NAS backup folders and have no Windows Users with the same credentials as are used by Acronis to backup to those folders.
Ransomware can attack any mapped drives / network resources that are visible to the Windows User that has been infected, especially if that user has Administrator privileges, and also if the same User credentials are shared across different computer systems.
Ah, the penny drops! Steve is correct. The fact that a file is password protected or encrypted does not of itself stop it from being encrypted again. The advice about mapped drives is sound.
Acronis offers both pasword protection and encryption. I always use both.
Ian
Thank you Steve and Ian, you are of course correct. Best practice, keep copies of backups offline not attached to the system is the only real way of complete protection at this point in time.
In addition in reference to iSCSI, that protocol is not officially supported by True Image. Doesn't mean it will not work but is not offically supported. I have never tried to use it myself but I can see where it may have issue when attempting usage of the Recovery Media is involved.
Since the OP is looking for a solution for a business another Acronis product may be better suited for the needs such as Acronis Backup 12 for example.
Pretty sure ISCSI support is in the Acronis Backup 11.7/12 Enterprise software, which is a little bit more in price, but not by much. Reach out to tech support via chat to confirm with them to be sure though.
I have not tried in Acronis True Image Home directly (although, as Enchantech mentions, it's not officially supported), but think it would work because ISCI support is possible with standard ADK. You just have to add the packages to the WinPE (after Acronis builds the WinPE recovery media, by injecting them into your boot.wim).
https://technet.microsoft.com/en-us/library/hh824926.aspx
|
Windows PowerShell |
WinPE-StorageWMI |
WinPE-StorageWMI contains PowerShell cmdlets for storage management. These cmdlets use the Windows Storage Management API (SMAPI) to manage local storage, such as disk, partition, and volume objects. Or, these cmdlets use the Windows SMAPI together with array storage management by using a storage management provider. WinPE-StorageWMI also contains Internet SCSI (iSCSI) Initiator cmdlets for connecting a host computer or server to virtual disks on external iSCSI-based storage arrays through an Ethernet network adapter or iSCSI Host Bus Adapter (HBA). Dependencies: Install WinPE-WMI > WinPE-NetFX > WinPE-Scripting > WinPE-PowerShell before you install WinPE-StorageWMI. |
Once your media is built with the add-ons injected, you can connect to ISCSI from the command prompt:
net start msiscsi <enter>
iscsicli QAddTargetPortal x.x.x.x <enter> (enter the actual IP of the ISCSI target)
iscsicli ListTargets T (lists the IQN names on the ISCSI target such as... iqn.blah.blah.blah:fileserver-iscsi-drive-target)
type the name of the correct target as displayed in the List target above and press enter to connect.
So then our backups are safe :)No, not guaranteed. Password protection means that you cannot open the backup archive files using the normal methods that Acronis provides either via the application or through Windows integration unless you provide the password. This does not prevent an encryption virus from encrypting the backup .TIB file if this is accessible to the virus.
That is what i wanted to know. So password on tib files is not protecting them from beeing changed.
Backup share will be totaly hidden from other users(usable only with \\nas\backup command), and of with different credentials only used by server.
At a disk / file system level, it malware can see and access the image file(s) then it could also attempt to encrypt the file(s).
The only 'guaranteed' method of protecting data is to have a completely separate offline backup held in a different location such as a fireproof safe etc.
yeah i know..
we will probably use cloud backup of somekind and offsite copy of backups
Luka,
Malware can also "delete" files so no amount of encryption will protect against that if it finds it's way to the data and the purpose of the malware is to wreak havoc. The contents of the data might be protected from being accessed, but that might just trigger the malware to make sure you can't access it anymore either :)
Offsite redundancy and/or offline backup redundancy is a good idea no matter what.