Let's address the approaches you highlighted first
Approach 1:
- As you stated, this doesn't resolve, nor prevent your files from getting encrypted if you're hit. It only creates more problems in the sense that you will end up with considerably less backups and be open to potentially more data loss.
Approach 2
You do not need to use Backupify, they were just suggesting their product. You can very well create your own file server (hosted or on-premise) and set up the same level of retention they offer. Beware of security however as they will undoubtedly surpass you in this area.
As you rightly noted this also doesn't resolve the problem as you will need to restore a backup from before your files got encrypted and this is always guesswork (unless you can forensically or otherwise determine the date the attack started).
Now this is what it all boils down to: Where services like Backupify offer value is in the length of retention. In your case, Let's assume you have used up 700GB of your 1TB drive (cos it can't be all used up right?). It wouldn't usually take months for most variants of ransomware to encrypt that amount of data but it could take up to 4 months for one of the slowest variants tested - see https://blog.barkly.com/how-fast-does-ransomware-encrypt-files.
Also bear in mind what hardware you are using, you might have 16gb of RAM and a quad core processor coupled with an SSD? Well that could almost halve the time to total encryption.
What can we do then?
The answer is really simple, plan for the worst and hope for the best. Knowing that there will always be data loss when ransomware hits is the first thing you need to accept.
From here, you will need to take further steps to prevent an attack in the first place (AVs, etc).
Next you will need to have a remediation strategy which is almost always going to be a restore from backups or to go bitcoin shopping.
Here you'll need to determine the longest window of retention you can afford. A smart approach will be to look at tests like the one above showing the time to full encryption and matching the slowest variant - so in your case, retain backups for about 4 months.
But there is a quicker and cheaper way
This only really works with incremental and (arguably) differential backups.
What happens when you wake up and review your backup logs to see that files you did not change have been backed up? Loads of them? - You immediately stop any further backups and roll back as quickly as you can!
Here you can afford a retention rate as low as a month provided you are diligent in monitoring your logs (and can remember stuff you've changed).
So there is my idea - monitor your backups daily and you will be able to tell when you have been hit and should be able to minimise data loss.
(Now this will be easy for you to implement / carry out a lone user but very difficult to replicate in a work environment... for that, we are still stuck at the "educating-the-users" stage).
