Snapshot and ransomware

Synology
1

Hello everyone,
I recently activated the snapshot option on my Synology server
According to what I understood from Will’s videos the best way to deal with a ransomware attack is to use a snapshot, but if the snapshot files are backed up locally, then what actually prevents the ransomware from changing them too?..
I understood that the snapshot files cannot be changed or deleted, but can it really be trusted?
What is the best method for protecting the snapshot files

2

Snapshots are not backup (unless replicated off-NAS). They rely on the source files that exist on your NAS. If their source files are encrypted, the snapshot is worthless.

3

I know that a snapshot is not a backup, I back up my data correctly to the cloud, but what is the best practice to back up all snapshots to an external backup? These are huge amounts that are only getting bigger
What does everyone who uses snapshots do and what method do they back up

4

I too was concerned about this when I initially set up my Synology NAS, to answer your question what do I do, in researching and watching Will’s tutorials, if I remember correctly, Snapshots on the BTRF copy-on-write file system, with any change to the file, does not actualy change the data on disk, it simply takes the change and saves it to a different part of the hard drive, pointing to it when next accessed. So in the event of a ransomware attack, you would be able to go back in time before the attack and restore. The virus ransomware attack would not be able to change the snapshots as they are read only. I use immutable feature as well. As NewLeaf points out, if you still do not trust that the snapshots are read only and/or immutable, or an event happens whereby your source files are compromised, then I would restore from a backup. These were the reasons I decided not to backup my snapshots, as my 3-2-1 backup strategy would be my next layer of data protection defense. I don’t use it, but there is an option to replicate snapshots to a remote Synology NAS which sounds like would address your concern.

5

Creating snapshots is the first step in a two-step process. The second step is to replicate the snapshot. You replicate snapshots to another NAS with a volume using the Btrfs file system.