5 ms·

Why is it not possible to create a storage solution that protects against ransomware? Of course, it is possible to do this but it requires considerable cost an

Why is it not possible to create a storage solution that protects against ransomware? Of course, it is possible to do this but it requires considerable cost and diligence. External hardware that only takes data from the target machine, for example - long timeline + key transactions logged. "Backup can't protect against ransomware" statements seem to be just shorthand for "your piece of shit backup doesn't protect against ransomware", which is true but when shortened doesn't seem like the right message.

dijit 5y ago
It’s actually a lot easier than that. Back in the day I was using these netapp filers which had read-only snapshot volumes which were mounted on .snapshot. It would be practically impossible to remove those snapshots as it would require root access to the filer head. ZFS, BTRFS and lvm has similar functionality.
- joe_the_user 5y ago
  Given current circumstances, it seems like hardware guarantees for numerous things are going to be necessary. Remember, we're solutions for people don't know WTF they're doing.
twistedpair 5y ago
It is; just move to the cloud. AWS S3 and Google Cloud Storage have Retention Policy Locks [1] and fuse bits in their buckets. e.g. set the retention policy on your backups bucket to 1 year and burn the fuse bit. Now files cannot be deleted or changed in that bucket for 1 year after their creation. Not even the account root owner contacting support can get it changed. No ransomware, short of breaking into the AWS or GCP control plane is going to compromise those backups. 1. https://cloud.google.com/storage/docs/bucket-lock#policy-locks https://cloud.google.com/storage/docs/bucket-lock#policy-loc... P.S. remember the write protect tab on old floppies/tapes ;)
- joe_the_user 5y ago
  Yeah, how hard is that? For kicks, an algorithm that contacts you multiple ways if it hasn't gotten a backup OR if the backup has a suddenly has a high diff from the previous backup.

dijit 5y ago

It’s actually a lot easier than that. Back in the day I was using these netapp filers which had read-only snapshot volumes which were mounted on .snapshot. It would be practically impossible to remove those snapshots as it would require root access to the filer head. ZFS, BTRFS and lvm has similar functionality.

joe_the_user 5y ago
Given current circumstances, it seems like hardware guarantees for numerous things are going to be necessary. Remember, we're solutions for people don't know WTF they're doing.

twistedpair 5y ago

It is; just move to the cloud. AWS S3 and Google Cloud Storage have Retention Policy Locks [1] and fuse bits in their buckets. e.g. set the retention policy on your backups bucket to 1 year and burn the fuse bit. Now files cannot be deleted or changed in that bucket for 1 year after their creation. Not even the account root owner contacting support can get it changed. No ransomware, short of breaking into the AWS or GCP control plane is going to compromise those backups. 1. https://cloud.google.com/storage/docs/bucket-lock#policy-locks https://cloud.google.com/storage/docs/bucket-lock#policy-loc... P.S. remember the write protect tab on old floppies/tapes ;)

joe_the_user 5y ago
Yeah, how hard is that? For kicks, an algorithm that contacts you multiple ways if it hasn't gotten a backup OR if the backup has a suddenly has a high diff from the previous backup.