4 ms·
It could be incredibly expensive to clean up. Remediation and recovery for most threats involves OS/app reinstallation, perhaps restoring from backups and imag
by mr_overalls 6y ago
It could be incredibly expensive to clean up.
Remediation and recovery for most threats involves OS/app reinstallation, perhaps restoring from backups and images. However, if your threat is a sophisticated state actor based out of Russia, it's hard to rule out that they're got hooks in your server's firmware, that they've corrupted your backups as well, etc, etc.
One wonders how Russia could exploit the systems they've penetrated. Brick every gov't system on Jan 20th? Shut down SCADA systems? It's a cybersecurity nightmare.
- panarky 6y agoThey've been inside since March, so any pre-breach backups and images are probably too old to restore.
- mrtnmcc 6y agoLast stable release was r2016.
- x86_64Ubuntu 6y agoI think he's talking about the hackers having been inside the victimized systems.
- unclekev 6y ago> Remediation and recovery for most threats involves OS/app reinstallation Except for all those SolarWinds admins arguing that doing a simple scan and infected binary removal is enough and then moving on and anything more is "overreacting" I feel sorry for all these people who are stuck working with such inflexible risk assessment/ITIL processes who are now trying to justify not taking any action because "SolarWinds said everything is ok"
- ownagefool 6y agoIt's quite a mess indeed. There's obviously a contemporary movement that all your systems should be rebuildable by code, which would make getting the systems back into a trusted state (assuming you trust other layers / your code) a lot easier. Obviously this doesn't help if your data is already messed up, if firmwares are hacked, and if your code itself hasn't had te rigour to be trusted, but it's a hell of a lot better position than "scan, remove, forget".