What is the best defence against this? Is there some software on hdd/sdd level that can detect file being encrypted?
I wouldn't describe that as the "best" defense though, it's an "earlier warning system" but not early enough to prevent damage. You've already been hacked, the criminals have already exfiltrated all the data they can, have already installed whatever backdoors they are going to, and have even already started preventing you from accessing some of your own data. (That doesn't mean earlier warning doesn't help, and it's probably worthwhile, but it's a component in a broader last line of defense system that you never want to use in the first place).
The best defense is not getting hacked in the first place, and not letting malware spread when you do. If you are a big enough target that the "detect ransomware" solutions are remotely affordable you should hire some experts on this topic, but think about things like good phishing training, good firewalls, good software engineering, keeping everything entirely up to date, and so on and so forth.
Backups help (a lot!) but are not the cure all that people like to pretend they are. Apart from all the other damage hackers do apart from deleting things, hackers do attempt to delete backups too, and sometimes they succeed.
(Disclaimer: I use to work on one of these products)
1. File history preservation. We use Dropbox Paper, which preserves file history - if someone were to delete all of our documents we could recover them.
This is harder to do for production data, which may take up petabytes of space. Archiving out the data in big chunks can help here (we back up our kafka data to S3, for example, and the exporter will do that in batches).
You can also enable object versioning on those S3 buckets or prevent deletion/ mutation of objects. Another good idea is to use a uuid in the key name so that they can't be guessed.
2. Remove all forms of lateral movement. Move to a 'zero trust' system. Ransoming one machine is not worthwhile, attackers need to own a lot of your network if they want to monetize. They usually do this by traversing over as many machines as possible.
None of our systems can communicate with each other in corporate environments, and there's no remote execution protocols like SSH in our production environment (between servers). All access is explicitly authenticated and authorized.
There's lots of other good defenses but IMO if you do these two things you're in a very good place.
I wouldn't recommend "backups" generically. It's hard to do backups well and safely. (1) is technically a backup, but it's how the system works normally, it isn't some separate backup system that never gets tested. Backups are also very expensive, whereas zero trust is cheap.
In reality the inverse is almost always true unless you are setting up a company from the start to be Zero Trust
Implantation of Zero Trust on an existing network and existing company with establish business processes that depend on a non-zero trust network well that can be very expensive to implement.
Also as we move forward in time with better and better immutable backup technologies the cost of the doing proper backups comes done.
Finally with modern Ransomware it is not just about the encrypted data, it is about data exfiltration as well. This is where the Zero Trust model come in, to prevent exfiltration.
At the end of the day Zero Trust and Backup are 2 different things, used for different purposes, Having Zero Trust does not mean you can forego backup. Having proper backups immutable does not mean can forego Zero Trust.
I didn't say it was one or the other, I recommended both.
Could you elaborate on this? I would have thought that they are at least in the same ball-park. I work at a large software company and we have a lot of internal systems one has access to. You have to harden your AD, you have to be very careful with single-sign on, etc. I'd bet, if I could compromise the machine of one of our employees I could do a lot of lateral movement. You must not only harden the production machine, you need to harden everything in the supply chain for those machines.
I don't think compromising our machines would be easy, nor do I Think lateral movement would be easy, but there's still more that we can do.
Backups.
Both offline media and well configured S3 can do. Although, I'd personally bet much more on my capacity of configuring a server than S3. Anyway, you can't go wrong with offline. The one thing you can't have is a NAS where your computers directly write the data.
(The opposite plays here, too. If everything you have is in the cloud, you should keep local backups.)