[Rathji]

Originally Posted by Azure

I was actually thinking about that yesterday. Reinstalling the OS would require popping in a new hard drive, installing OS and all required programs, and copying data. The data is already backed up, so that would be the easiest part.

However, reinstalling OS, our CAD software, Office, and other essential programs would take maybe 3-4 hours. Is it really worth keeping a disk image for 15 computers so I don't have to do that?

As for what files, they are mainly Excel Files, PDF, Word, and CAD drawings. Our email is all on Office 365, but we haven't upgraded to the cloud for anything beyond that.

Our CAD files and quotes for projects are the most important. Thousands of drawings, with sizes ranging from 30 MB, to 1 GB per drawing. The quotes are PDF files smaller than 30 MB, but often 10-20 quotes per project. Not being able to access those would cripple our business.

Currently for those files everything is accessed from a file server. We back that up every hour in case someone messes up a drawing and needs to go back and retrieve the old one. From there it is backed up to a Synology on site, and then to another Synology off site. The cloud backup would be another backup similar to the off site Synology.

My biggest concern is stopping ransomeware from getting into the cloud backup. The whole ransomware idea is new so I'm trying to figure out what the best practices are, but my understanding is that it needs admin privileges to get into the files. For the sake of argument, say it infects a work station, which in turn infects the file server, which in turn infects the Synology on site, then the Synology off site, etc, etc....what is supposed to stop it from spreading short of actually have one of the backups plugged out?

The off site Synology is still on the same network. Just off site in case of fire or theft.

The offsite (edit: Cloud) backup should have versioning, which prevents the encrypted file from overwriting the good data.

Otherwise, unless the virus is stealing your credentials for your backup and logging into the backup site and actually deleting your old versions, there is no way for the virus to encrypt those versions. They simply don't exist in a form that they can be accessed like a Network share does