Protecting Linux Users Against Ransomware: Essential Backup Strategies

The number of data breaches worldwide has been growing at an alarming pace for over a decade now, and it shows no signs of stopping any time soon. New and improved versions of malware and ransomware are being developed regularly, finding all kinds of loopholes in virtual security perimeters for malicious purposes. 

In this context, it should not be surprising to see cybersecurity becoming the forefront of a company’s development strategy since everyone now understands the cost of a single data breach and what it could do to an unprepared business. 

The Rise in Linux Ransomware & Its Implications 

Ransomware has also been one of the most significant cybersecurity issues and a massive headache for practically every IT professional. The primary purpose of ransomware is to find sensitive data to render it inaccessible via encryption – while demanding ransom from the data owner for the decryption key. 

Since ransomware was not designed to steal data in the first place, it became a massive issue for most traditional security systems not designed with ransomware in mind. Add that to the fact that ransomware has been developing and evolving for over a decade, and it becomes clear why cybersecurity is so important for companies of all sizes.

A single unfortunate data breach or ransomware attack can completely paralyze any business. This same average attack can cause days, if not weeks, of issues for large-scale companies, usually resulting in millions of dollars of lost revenue. 

As if that was not problematic enough, newer versions of ransomware have also started to look for safety precautions such as backups. Suppose there is just one copy of a company’s data that has been made, and it was encrypted by the same ransomware that affected the original data. In that case, the entire company has a high chance of crumbling instead of recovering.

Why Are Data Security & Secure Data Backup Crucial in Protecting Against Ransomware?

This is how we arrive at the topic of data security. Data protection is an intense and complex topic, and not all of them are about ransomware protection. However, since it is one of the most prominent threats to an average business, we should start with the basics of protection against ransomware.

As mentioned, backups are usually treated as one of the easiest ways to protect sensitive data for companies and individuals. The act of copying information is simple, does not take much time, and can be an excellent safeguard in case anything goes wrong.

Unfortunately, the description above is only suitable for about a decade ago. Modern backup solutions are far more complex and sophisticated than ever, and the same could be said for the average business infrastructure. Not only can businesses store their data on traditional storage mediums such as disks, but storage possibilities can also be found in tape storage, cloud storage, virtualization, databases, and clusters.

The drastic increase in complexity for business infrastructures led to an identical rise in backup complexity. In the modern world, a secure data backup represents multiple copies of data stored on different storage mediums. This is what the industry refers to as “the 3-2-1 rule”.

This rule is not particularly difficult by itself – three copies of data, stored using two different storage mediums, and one copy held in long-term storage in a different geographical location from the rest. This rule is also somewhat outdated, with some professionals pushing for “the 3-2-1-1” rule instead – adding one more copy of data that is held using immutable storage.

Storage immutability is not a new invention by far – the concept of data that cannot be modified in any way once it has been written has been around for many years now. And yet, the rise of cybersecurity brought much attention to finding alternative data protection methods, including data immutability. The topic of “locked” immutable data backups was also one of the first solutions to the issue of ransomware learning how to target backups.

Of course, only some things in this topic revolve around data backups. Many other methods and tactics are used to lower the chances of a ransomware attack. Data retention is one such example – a combination of best practices and policies created to mitigate the potential damage from a ransomware attack in the future.

Multiple best practices can be implemented to mitigate risk, including:

• Putting more emphasis on complex passwords and password rotation systems.
• Use separate accounts for backup-oriented tasks while restricting these accounts’ capabilities in terms of everything unrelated to backup jobs.
• Ensure backup account passwords are appropriately secured or stored in a password vault.
• Implement a password-changing policy to ensure no past employees can access backups after leaving the company.

Both backup jobs and data retention are just the tip of the iceberg regarding ransomware protection measures. Other examples of appropriate data protection capabilities include backup encryption, encryption key management, regulatory compliance, backup testing, and many others.

Why Is Ransomware Especially Threatening to Linux Users?

The topic of ransomware becomes even more expansive once the Linux operating system is brought into the picture. Most previous examples have been attributed to Windows-oriented software and hardware, but Linux devices differ. 

Linux is a well-known group of operating systems with an open-source basis. Some of its most significant advantages are extensive customization and a high level of control over the system as a whole. This freedom is one of the biggest reasons why plenty of people choose Linux over Windows as their primary operating system – for personal and commercial use.

However, this kind of customization and control over the entire system comes at a cost. If the ransomware succeeds in getting into one such system, it can take control over practically every single file in the OS, including system files. A detailed backup plan is the only option for mitigating these issues.

Ransomware has been one of the most prominent threats in the cybersecurity field for a few years now, and it keeps evolving at an alarming pace. The overwhelming majority (about 85%) of ransomware types are only capable of working on Windows devices to this day – but the size of the Linux portion is getting more and more attention as time goes on.

It is common for Linux-based systems to store important information, be it sensitive databases, government files, or web services. Linux and Windows have plenty of differences regarding their internal structures, and these differences are some of the biggest reasons why ransomware isn’t as popular on Linux devices. 

Windows OS uses a specific database type called registry to store its settings and configuration options, and practically any backup must back this data up for backups to be restored properly. On the other hand, Linux OS uses a much more file-oriented approach where both settings and config files are stored within the file system alongside user data. This is an advantage for backup and recovery processes, but it can also be a potential security issue if some sort of ransomware gets into the system.

What Are the Basic Steps in a Linux Ransomware Attack?

Since there are not that many different ransomware types on Linux, we can figure out the basic steps that each ransomware has to go through to perform the cyber attack: 

1. Infection. Vulnerability abuse is one of the prime gateways for ransomware since it is not as easy to infect a Linux system with ransomware via infected advertising or emails as on Windows devices. As soon as the ransomware gets inside the system, it initiates downloading a hidden executable by “phoning home” via a specific list of IP addresses.
2. Setup. This is where the ransomware sets itself up for the following attack – including changing folders and giving itself more capabilities within the system via permission modification and config modification. This is also where the random encryption key for the following encryption process is generated on the server side. 
3. Scan. Ransomware has to find predefined data types or repositories to ask for ransom, and this process revolves around scanning the infrastructure for vulnerable and vital data in accordance with pre-defined parameters.
4. Encryption. The attack itself commences at this step, and it is also the first step on the list that brings in potentially irreversible changes to the infrastructure – creating encrypted versions of existing files and folders and deleting the original file copies afterward.
5. Extortion. The only step left to do after the encrypted data is to ask for ransom by providing explicit payment instructions to the end user in some way, shape, or form.

Secure Data Backup is a Universal Concern

It is also worth mentioning that some of the best data backup practices apply to both Linux and Windows environments – although their implementation methods might differ. A well-known technique of “air-gapping” is one such feature, allowing for a specific hardware appliance to be wholly isolated from the rest of the infrastructure, making it a lot more challenging to infect or delete for malicious purposes. 

The general advice for diversifying backup and security measures is common for all operating systems since backup diversification lies at the core of a proper backup strategy. Combining multiple storage types and security measures within the same system leads to improved security and a higher degree of protection against potential threats. A higher number of different security layers directly correlates with a lower chance of a specific system or infrastructure being breached.

Data protection as a topic can be challenging to work with, especially for larger companies with sophisticated infrastructures. Choosing the appropriate third-party backup solution can be a great advantage in this context. A proper complex backup platform would greatly help with various protective measures and tactics for appropriate backup protection.

Final Thoughts on Secure Data Backup for Linux Users

Data security is an ongoing process that must evolve and adapt to face new challenges. It is easy to see an initial investment in a complex backup solution as a negative factor. At the same time, it is worth remembering that most data breaches and ransomware attacks usually significantly damage a company’s financial situation and reputation more than an initial investment in a sophisticated backup platform.