DEV Community

Discussion on: A cron job that could save you from a ransomware attack

Collapse
 
montanaviking profile image
montanaviking

Personally, I run my company's main server and I use Ubuntu Linux with ZFS on Linux filesystem to defend against ransomware. While ransomware "probably" doesn't run on Linux, it could, of course encrypt data on our Linux server which is served to our engineers' Windows machines. I address this threat by:

  1. Having automated snapshots running on ZFS. These are read-only incremental backups of our filesystem.
  2. Sending those snapshots to an external hard drive(s) for physical backup. Unless the ransomware knows ZFS AND can escalate to root privileges, the threat of this malware to ZFS data is minimal. Merely making backups can still expose you to risk because if the ransomware can access your backup drives, it will encrypt those too. So you would need to ensure that the backups are accessible as long as you're performing backups AND the mere act of performing a backup on such systems (without read-only snapshots) opens a window of vulnerability during the backup process - which can take hours. Moreover, I have our system set to perform backups every 15min - so you would lose at most, about 30min of work should ransomware strike - not a full day lost. Best