3 ms·

Your backups will contain all the backdoors that the attackers managed to deploy - so even ignoring the normal massive effort of restoring all your computers, y

Your backups will contain all the backdoors that the attackers managed to deploy - so even ignoring the normal massive effort of restoring all your computers, you can't simply restore backups, you need to carefully audit everything that you're restoring to clean hardware, and you need everyone to change their credentials (and not just by appending "2" at the end) otherwise you'll be owned again immediately afterwards.

TwoBit 6y ago
I think you only want your data files from the backup, not system files. But yeah some kinds of "data" files can be compromised too.
- PeterisP 6y ago
  If you want to restore operations of a large company, data files are not really sufficient - if you have the data, but need to rebuild all the internal server and application infrastructure and configuration, then that's going to take you a very, very, very long time. It's tricky to rebuild from scratch even basic things such as email, file sharing, payroll and inventory control systems, etc when spread out over many countries and offices and scaled to, say, 10000 employees over the world; much less something like a smelting plant control system developed 25 years ago by a company who's now out of business. Disaster recovery can be quick if you can restore hundreds of virtual servers (and you're going to have hundreds), whole key machines, and all the user and network config from backup. If all you have is data files and bare hardware, then the business is going to have a lot of expensive downtime while you rebuild all the infrastructure. "cattle not pets" approach and automated provisioning of machines from config files helps in this regard, but almost no company has that for all their critical infrastructure, especially if we're talking about non-IT companies whose critical infrastructure is not some single consumer-facing app (e.g. Twitter), but a diverse, distributed collection of third-party IT solutions for various business-critical needs.

TwoBit 6y ago

I think you only want your data files from the backup, not system files. But yeah some kinds of "data" files can be compromised too.

PeterisP 6y ago
If you want to restore operations of a large company, data files are not really sufficient - if you have the data, but need to rebuild all the internal server and application infrastructure and configuration, then that's going to take you a very, very, very long time. It's tricky to rebuild from scratch even basic things such as email, file sharing, payroll and inventory control systems, etc when spread out over many countries and offices and scaled to, say, 10000 employees over the world; much less something like a smelting plant control system developed 25 years ago by a company who's now out of business. Disaster recovery can be quick if you can restore hundreds of virtual servers (and you're going to have hundreds), whole key machines, and all the user and network config from backup. If all you have is data files and bare hardware, then the business is going to have a lot of expensive downtime while you rebuild all the infrastructure. "cattle not pets" approach and automated provisioning of machines from config files helps in this regard, but almost no company has that for all their critical infrastructure, especially if we're talking about non-IT companies whose critical infrastructure is not some single consumer-facing app (e.g. Twitter), but a diverse, distributed collection of third-party IT solutions for various business-critical needs.