• 0 Posts
  • 132 Comments
Joined 2 years ago
cake
Cake day: June 17th, 2023

help-circle


  • The only thing I can think of is to do a restore of all the backups in sequence, assuming they’re all of the same thing. That would give you one consolidated image. Then you could run some deduplication and take a new single backup, if desired.

    But really it’s so subjective that I don’t think there’s really any way to automate it. I would mount all the backups, go through everything, pick out what you want to keep, and delete the rest.

    Look at it this way. If you’ve had the backup for years, and never needed to restore any of those files, how likely are you ever need them in the future? Even if you did delete something you later wanted, how life-threatening would it be to not have it?

    Or you could take the easy way out and just add more storage.









  • A modern firewall might also block connections to known bad sites, in case you do somehow get malware reaching out to a command & control server. Or it might identify malicious application traffic over a port that should be for a more trustworthy service.

    But these are usually only a concern in places like businesses or schools where there are a lot more people, devices, etc. on the network, especially if there’s a guest network.


  • SheeEttin@lemmy.worldtoSelfhosted@lemmy.worldAlternative to ClamAV?
    link
    fedilink
    English
    arrow-up
    3
    arrow-down
    1
    ·
    2 years ago

    That’s what modern endpoint security is, really. Traditional AV is dead. There are far too many people making malware for file signatures or heuristics to keep up. Instead, you want to look for behavior on the system and on the network. For example, if a program starts reading every file it can find on the network, and changing then from their current formats to unreadable blobs, that’s probably ransomware and should be stopped. Plain old AV probably won’t catch it on the client because of how frequently it gets modified (plus all the various evasion techniques), nor on the server because nothing unusual is running on the server.