Deny access to change file extension in shared folder?

Question

Is it possible to deny users from changing files extensions in a shared folder? I'm asking that to try and avoid ransomware infection. I will deny people from changing file extensions inside the shared folder, so the encryption process won't touch shared folders..?

Answer 1

There are many problems with this approach:

• There's no NTFS File and Folder Advanced Permission for only denying file extension/name change, only denying write and delete permissions would include this. SMB / NFS permissions are even more limited to general read/write access.

• A ransomware doesn't just change the file extension. The extension is only needed for identifying the encrypted file for recovery. The contents can be modified before this, or the original file may be deleted altogether, and new file created. You could possibly end up having no file at all by an approach that tries to avoid writing the encrypted file instead of destroying the original.

• Securing the shared files doesn't prevent the infection, just a part of its impacts.

Better approaches:

• Detect malicious activity e.g. when a user tries to modify several files in short period of time. Drop the connection, deny access and automatically alert administrators to start the actual actions against the malware: clean the originating computer, avoid further spreading etc.

• Have a decent backup system. One would be incremental, having several versions of the files from adequate period of time. Don't allow users access to the backup location; have an external, independent user/machine that does the backup from outside. Whatever overwrites the files to be protected shouldn't have access to the backups. Possibly reinforce with offline backups.

  Backups are the only actual cure when a (crypto)ransonware hits, and eventually one will cause problems to some of your users, no matter how good your preventive measures are or how good virus protection you have.

• Despite the previous, also have virus protection, email filtering, intrusion prevention system etc.