Does backup encryption prevent crypto from encrypting bkup?

[ceez]

hi everyone,
if you havent heard there's a new crypto version in town called cryptofortress. this one will just find any share on your network and encrypt....the network drives dont have to be mapped to the infected host.
so with this comes the worry of getting infected and catching my backups which are no mapped to any other host other than the veeam backup server.

I know that the new version of b&r has encryption, would encrypting my bkup jobs prevent crypto from encrypting them? I assume that you can't write over a file that's already encrypted but it's good to find out.

thanks!

[Vitaliy S.]

Hi Cesar,

Encryption does not prevent 3rd party malware tools or viruses from corrupting backup files data. Proper antivirus tools are still required. If you want to minimize the chance of losing all your data, I would suggest doing backup copies to an offsite location, or a Cloud Connect provider.

Thanks!

[jazzoberoi]

It may help to keep copies in NFS shares with host level write protection ?

[Vitaliy S.]

If the above mentioned malware can't access it, then this could be a temp solution.

[ceez]

So encryption at the moment would prevent unauthorized users from restoring the information.

I would also assume that since a file is encrypted that crypto wouldn't be able to "re-encrypt" it since the file is already encrypted.

thanks everyone.

[Vitaliy S.]

Well.. the process should be similar to zipping files twice, no one prevents you from doing it.

[dellock6]

If by "crypto" you mean cryptolocker and such ransom tools, no even our encryption cannot keep them out. As Vitaliy said, anyone can encrypt multiple times the same file.
What you can do to protect backup files is to keep at least some copies of them offline. Being it copies to a removable device (tape, usb drive) and PHYSICALLY remove the device from the environment, or another solution is to have a secondary storage in the network running windows or linux, that have read access to the original repository, but it's NOT accessible from this (no domain join, different credentials). Using such a configuration, you can create copy script in this device to create secondary copies of your backup files, but even if infected the primary Veeam device will not be able to access this secondary one. In this way backup files will still be "online" in a way, but not readable and most of all modifiable from the rest of the network.