Best write-only backup solution to stop ransomware? | Hacker News Reader

Best write-only backup solution to stop ransomware?

4 pointsdaly9 comments

Is there a good write-only backup solution?

The best case would be incremental backups to DVDs since they don't allow modification.

Layered on top of that would be a git-like difference algorithm that stored changes rather than whole files.

Truly ideal would be a "write through" backup solution so that the "backup" sits between the computer and the hard drive, writing journal-like changes "on the fly".

Such a solution would make ransomware useless. Even if you encrypt the whole filesystem the backup device could do a git restore.

Does such a solution exist?

If so, is there a better medium write-only medium than DVDs?

View on HN

There are immutable back uptions out there. Depends on what you are trying to backup

For an enterprise many of the backup systems have immutability. Veeam for example has really focused on immutability in the last couple of releases

Also S3 and most S3 complatible cloud storage has immutable or delete protection option built in

AWS has a service called S3 Object Lock that provides a WORM model:

https://aws.amazon.com/blogs/storage/protecting-data-with-am...

I'm actually looking for local hardware solutions.

Sending every change to everything up to AWS would be wildly expensive both in bandwidth and cash. It would also put all of your data "in the cloud" (aka on other people's computers).

Plus a ransomware attack on AWS would make the backup unavailable.

A small, local device that contains a memory cache could write a DVD once half the cache is filled (double buffering).

A double-sided, double-layer DVD can hold 16GB so an "inline cache" with 32GB could copy and store a DVD worth of disk backup and then write a DVD.

BLU-RAY can store up to 50GB

BDXL holds 100 GB so if a few of those are enough to hold your backup that's what you should do. The cloud will look cheap once you see the price of LTO or Optical Disc Archive drives.

For business use, I think any backup/archive system that keeps multiple backups should be safe enough against ransomware since you can restore from the newest uncorrupted backup.

I've looked at tape backup. It seems to have 2 problems. Tape is re-writeable which means that a ransomware attack could overwrite the tape.

Tape is wildly expensive for some reason. This seems odd to me. I wrote a tape-based archive system in the 1970s. Most technologies have gotten cheaper. Tape has not.

There are WORM tapes. Tape no longer has economy of scale so it didn't get cheaper while other technologies did.

I'm not aware of any Blu-ray robots so at large scale your choices are limited to disk, tape, or ODA which are all fairly expensive.

I can not imagine backing up one dvd at a time. Not only would that be impractical for most applications. Even my home I have several TB of data, for a business that would be much more.

Dvd's are unreliable as a long term storage media due to physical damage or if it is a rw dye decay

To answer your last question Blu-ray, especially M-DISC. Can store up to 100GB [0].

[0] https://en.wikipedia.org/wiki/M-DISC

If this doesn't exist it is probably a good opportunity for a startup. Ransomware seems to be increasing.

Reply on news.ycombinator.com