Ransomware/Cryptolocker news articles popping up

[Buffy]

We haven't experienced this yet, but wouldn't a third party cloud solution be a viable backup?

Our organization uses two forms of automated backups. We use Google Drive for local user data backups, and we use a network drive (z) for automated backups.

This would be more on google than on us if Google got problematic, but for those that have experienced this before, is there a reason I can't just re-install Windows 7 and have them re-sync to google drive? I guess what I'm asking is could cryptolocker lock the files that are uploaded to google drive, making them useless for backup purposes?

Our organizational philosophy is "we give you two ways to backup, if you don't do it and lose your data, that's on you - sucks to be you".

[bungiefan]

We are pushing out WatchGuard policies preventing sending of compressed files and EXE files, as well as forbidding encryption via Group Policy, and forbidding software to run from AppData.

If Google Drive/SkyDrive/DropBox is set to synchronize with the folder on their computers, then when CryptoLocker encrypts the file, the sync will see the change and overwrite the online file with the now encrypted file. If it's a network drive mapped to a drive letter, and the user has write access to any files on the network drive, CryptoLocker will go after every file on the drive with an extension it is set to attack and will encrypt all files that the user can write. It doesn't go after shares that aren't mapped to Windows drive letters, yet.

You need an offline backup, or at least one that users don't have direct write access to, like having your production environment run in a VM, and having the backup software run on the host that is running the VM, so that backups aren't directly visible to any process running in production, and thus can't be overwritten/altered by malware that gets loose. Unitrends is one such backup solution that lets you keep an appliance locally for backup, so you don't have to pull a huge amount of data from outside your network.

Cloud backup is a good last resort solution, but sucks if you have to pull hundreds of gigabytes of data to restore a backup. Also, creating the initial backup that way can be a pain without mailing drives off. Say you are in Alaska/Hawaii/rural location and have 1 TB of data to back up. It will be several weeks before the initial backup is uploaded unless you have it on a local backup appliance. Pulling the information back down in case of an emergency will be the same thing. If your internet is metered, even worse.

3-2-1 security policy is what you should be following.

[Lucki]

Whats everyone else here pushing out to their users in terms of virus/malware protection?

We use Dell's K1000 to push out Forefront for AV protection as well as CryptoPrevent out to all the computers we support. It's popped up on campus, but so far nothing we service.

[Ratatapa]

ESET Nod32 here nothing problematic up to date

[Tokitoki]

Our company just got hit as well. The owner seemed to have opened something he shouldn't have and it hit our network. The IT company we use has Trend Micro on all our computers.

Luckily we only lost data from before 9am that day as far as project files, but they were not backing up the owner's desktop (which is where he saves everything; stuck in the past). He ended up paying the ransom to get his files back.