5 ms·
> Surely you should be backing up in an append only fashion initiated from the backup server The key idea is assuming everything is compromised. Whether you us
by halfcat 6y ago
> Surely you should be backing up in an append only fashion initiated from the backup server
The key idea is assuming everything is compromised. Whether you use append or whatever, is not helpful if the functionality to change that configuration exists, because that gets changed, backup server is gone, backup storage is gone, etc.
You have to design a system where even a rogue IT admin with full access to everything can’t screw you. Usually that involves third parties where there is no mechanism for a rogue IT person or other attacker to delete your offline backups. So some people have Iron Mountain pick up disks in a lock box daily, or use an online backup service that specifically has features for this, where they keep extra copies of your backups completely offline and provide no mechanism for the customer to delete them.
- rectang 6y ago> You have to design a system where even a rogue IT admin with full access to everything can’t screw you. OK, brilliant — this is a nice articulation of a fundamental principle. Do you know of any books that describe how to design such systems? Guaranteeing that offline backups exist is a great start, but if the backups contain backdoors, restoring could be extremely laborious and yet unsuccessful.
- scott_w 6y agoI never considered the rogue sysadmin perspective but it’s a good point! I do wonder if some of my misunderstanding is because my experience is mostly SaaS companies, so paying external providers is more “natural” vs a company that makes its money selling units.