Protecting Backups
Is there a way to password protect Acronis at launch?
For example, let's say the PC running Acronis True Image is compromised. Even if you've hardened your backups against ransomware and other network attacks, couldn't a malicious actor simply load Acronis, then clean up/delete your online backups from within Acronis prior to trashing your PC? By online backups, I'm referring to any backups accessible by Acronis, whether they're on a NAS, attached USB device, or cloud storage.
I personally backup to a NAS, and on Friday mornings, plug a portable USB drive into the NAS. The NAS replicates the backup folder to the USB drive as soon as it's detected, then ejects the drive. I'm doing this specifically to circumvent the perceived security hole I just described.
Along the same lines, how are SMB/NFS credentials stored in Acronis? And can they be accessed/retrieved outside of Acronis, once stored? Being able to store the credentials is great - it eliminates drive mappings, but if I can just open Acronis to access/delete your backups...
Are there plans to password protect the Acronis True Image console/interface in future versions?
If a malicious actor / hacker is able to compromise your PC then sorry but all bets are off especially if the compromised account is an Administrator as all applications are open for the person to abuse.
If you are backing up to the Acronis Cloud, then definitely use the option to encrypt your backups as any attempt to delete them will prompt for that encryption password to be entered or will fail. Encryption can also be applied to backups to other locations such as your NAS but this will only prevent the files being deleted from within the Acronis application. If the hacker has access to the NAS via a mapped network drive etc, then the files remain at risk of being deleted by other means.
Hello Harold!
I'll add what I know from the point of Cyber Protect, because many of these concerns are product agnostic.
As far as I observed credentials are stored encrypted, and the database they are stored at is itself encrypted, so you can't just open it up with a database editor and look at them.
The management console for Cyber Protect requires credentials to access, but if it's compromised it's not helping you protect your backups from deletion either.
The risk of destroying backups by deleting the files themselves is imo no different, than gaining access to a database server and deleting database files. You have to carefully manage the credentials, as you would for any critical systems.
-- Peter
Steve Smith wrote:If a malicious actor / hacker is able to compromise your PC then sorry but all bets are off especially if the compromised account is an Administrator as all applications are open for the person to abuse.
If you are backing up to the Acronis Cloud, then definitely use the option to encrypt your backups as any attempt to delete them will prompt for that encryption password to be entered or will fail. Encryption can also be applied to backups to other locations such as your NAS but this will only prevent the files being deleted from within the Acronis application. If the hacker has access to the NAS via a mapped network drive etc, then the files remain at risk of being deleted by other means.
I'll do some testing today. If it is correct that the encryption key is needed in order to delete backups from within Acronis, then that alleviates my concerns. As I mentioned, there are no mapped drives to my NAS. As long as my NAS credentials and encryption key can't be extracted from Acronis, then my backups should be safe. Will follow up.