I have a client who was recently hit with a very new variant of Cryptolocker. Unfortunately the user who got hit had a high level of access to the system. Apparently there is no educating some people.
It occurs to me that it should be possible to mitigate damage if it were possible to make a copy of each file (eg onto SSD) whenever (but prior to) it being written, and delete these files out as they age overnight, but I do not know a way to do this.
Does anyone know of technical steps which can be taken on a Linux SAMBA server to mitigate Cryptolocker, and which does not rely on limiting user access or relying on AV. (Our AV software did not pick it up as the threat emerged only hours before the user was hit)
Putting data on an Logical Volume and taking regular snapshots has occurred to me, however I understand that snapshots have a huge penalty on performance which I'm hoping to avoid.