What is malware scanning of backups?
Malware scanning of backups is the inspection of backup data for malicious software, either as it is written or before it is restored. Its purpose is to avoid bringing an infection back into production along with the data, and to help identify which restore points predate a compromise.
Why scan backups at all?
Attackers are often inside a network for days or weeks before they act. Backups taken during that time faithfully capture whatever the attacker installed: remote access tools, scheduled tasks, altered system files. Restoring the newest backup after an attack can return the environment to a state the attacker still controls. Scanning adds a check between the backup and its reuse.
When and how are backups scanned?
Scans can run at several points, each with different coverage and cost.
| When | How | Strength | Limit |
|---|---|---|---|
| During backup | Inline checks on data as it is read | Early warning with no extra job | Limited depth, must not slow the backup |
| After backup | Restore point mounted and scanned with antivirus signatures | Uses current signatures on old data | Takes time and compute |
| Before or during restore | Scan as part of the restore workflow | Stops known malware returning | Adds time when time is short |
| In a clean room | Restore into an isolated network, then inspect | Deepest inspection | Slowest, needs a prepared environment |
What can scanning detect, and what can it miss?
Signature-based scanning finds malware that is already known. Rescanning old restore points with new signatures is valuable for that reason, since a tool unknown on the day of the backup may be recognized a week later. Indicators supplied by an incident response team can be searched for in the same way. What scanning misses is anything without a signature: custom tools, legitimate administration software used maliciously and changes to configuration. It is therefore combined with entropy detection and other anomaly checks, and with investigation of when the intrusion began.
How does scanning fit into recovery?
The practical output of scanning is a judgement about each restore point: clean as far as can be told, suspect or infected. That feeds the choice of a clean restore point. For it to work, scan history has to be kept somewhere the attacker cannot alter, and the backups themselves must be immutable, so that a known-good point is still there when needed. Choosing a clean recovery point covers the decision.
Frequently asked questions
Does scanning backups replace endpoint protection?
No. Endpoint protection aims to stop an infection. Backup scanning aims to avoid restoring one.
Can encrypted backups be scanned?
Yes, by the backup software that holds the key, typically by mounting the restore point. Storage that sees only encrypted data cannot inspect its contents.
Does a clean scan prove a restore point is safe?
No. It shows that no known malware was found. Unknown tools and configuration changes can still be present.