How to protect backups from encryption viruses? And preferably in automatic mode?

Question

Backup

In the light Did encryption viruses appear that cannot be decrypted in principle? , the question arose: how to make backups 100% inaccessible to encryption viruses?
The thickness of the Internet channel in the enterprise and the volume of backups make cloud storage uninteresting.
The option of connecting, for example, a USB-HDD and synchronizing backups with it, seems to be effective, but this is a manual hassle. To do this, you need to:
1. Do not forget
2. Disconnect the backup server from the network (so that all backups do not accidentally crash).
3. Connect USB-HDD
4. Start synchronization.
5. Disconnect USB-HDD
6. Connect the backup server to the network
What else can be done, and with a minimum of manual manipulations?

Answer 1

Well, for example, you can use the standard backup functionality.
In order for the virus not to overwrite the data, it is done simply - the virus should not have access to the folder with the backup.
That is, a backup should be made by a special backup user who has write permissions to the backup folder, and everyone else should not have such rights.
As a result, the ransomware running on behalf of the user will not be able to do anything with the backup.
The simplest option - create a backup user, give him the right to write to the backup folder.
You take away this right from everyone else, even from administrators .
More advanced option- a backup server available over the network, you drop the backup on the ball of this server, and the server's firmware transfers it to a storage inaccessible over the network.

Answer 2

You need to use normal software specifically designed for backup. Copies should not be accessible by means of the OS, so USB-HDD disappears immediately, network balls - too. Copies should not be overwritten, otherwise the backup of corrupted data will kill entire copies. To start like this.