4 ms·

From a reply the poster made in that thread: "So, we have backups on an encrypted drive, which we can't access (authentication is done via our custom ERP softw

From a reply the poster made in that thread: "So, we have backups on an encrypted drive, which we can't access (authentication is done via our custom ERP software, which is down as well - in hindsight, a very bad idea). And the backups don't work. We can rebuild the DNS servers from scratch, and the records are probably still safely stored somewhere inone of the 3 different databases our ERP software uses, but we don't have an authentication key or the scripts used to pull the DNS domain / record information from the ERP system anymore. The API's are undocumented, and there's only one key that can access those records." Elsewhere, they say that two years ago, they found they were unable to restore from backups...

ansible 6y ago
> Elsewhere, they say that two years ago, they found they were unable to restore from backups... So their business actually failed a couple years ago, and they have only noticed this month.
- lupire 6y ago
  They noticed 2 years ago, and the ship sank below the water line this month.
  - TeMPOraL 6y ago
    They were already dead 2 years ago, the body just didn't realize it and kept moving until last Friday...
- ptero 6y ago
  That isn't the failure of the business; backup failure is a screwup of the IT, which I think is not that uncommon. But the fact that after this event the management did not get it fixed (and requested that IT demo it, three times, with no failures) is an existential failure.
- koonsolo 6y ago
  The technical people noticed, left, and they had to hire new ones who didn't know yet. Now the new ones also know.
- hackeraccount 6y ago
  Basically Wile E. Coyote running in the air.
raverbashing 6y ago
I'd say if it was such a house of cards, my best bet is that this security chain is full of holes. Maybe the ERP used a fixed password, which can be guessed/bruteforced.
- mysterydip 6y ago
  honestly, "password" would be my first guess.
  - jiggawatts 6y ago
    Oh come now, there are password complexity policies in place in any modern software! Try: password123.
    - abruzzi 6y ago
      it doesn't sound like modern software. At my current employer (to remain unnamed) when I started there were a bunch of MS-SQL servers with an SA password of <blank> (i.e. no password). It took a long time to fix that because we had hundreds of local installs of the client app that had SA/<blank> in the app config file (yes, they were setup to access as system administrator), so fixing it meant reconfiguring hundreds of local installs. (at the time we didn't have a mechanism for automating it.) We still have "enterprise" software that does no password rules, and would happily allow a blank password.
    - yrgulation 6y ago
      Oh please, even such a crappy place knows better. Its Password123. Adding capital letters makes it more secure.
      - neogodless 6y ago
        But hackers might be expecting capital letters, so disallowing them from passwords is more secure!
    - fctorial 6y ago

ansible 6y ago

> Elsewhere, they say that two years ago, they found they were unable to restore from backups... So their business actually failed a couple years ago, and they have only noticed this month.

lupire 6y ago
They noticed 2 years ago, and the ship sank below the water line this month.
- TeMPOraL 6y ago
  They were already dead 2 years ago, the body just didn't realize it and kept moving until last Friday...
ptero 6y ago
That isn't the failure of the business; backup failure is a screwup of the IT, which I think is not that uncommon. But the fact that after this event the management did not get it fixed (and requested that IT demo it, three times, with no failures) is an existential failure.
koonsolo 6y ago
The technical people noticed, left, and they had to hire new ones who didn't know yet. Now the new ones also know.
hackeraccount 6y ago
Basically Wile E. Coyote running in the air.

raverbashing 6y ago

I'd say if it was such a house of cards, my best bet is that this security chain is full of holes. Maybe the ERP used a fixed password, which can be guessed/bruteforced.

mysterydip 6y ago
honestly, "password" would be my first guess.
- jiggawatts 6y ago
  Oh come now, there are password complexity policies in place in any modern software! Try: password123.
  - abruzzi 6y ago
    it doesn't sound like modern software. At my current employer (to remain unnamed) when I started there were a bunch of MS-SQL servers with an SA password of <blank> (i.e. no password). It took a long time to fix that because we had hundreds of local installs of the client app that had SA/<blank> in the app config file (yes, they were setup to access as system administrator), so fixing it meant reconfiguring hundreds of local installs. (at the time we didn't have a mechanism for automating it.) We still have "enterprise" software that does no password rules, and would happily allow a blank password.
  - yrgulation 6y ago
    Oh please, even such a crappy place knows better. Its Password123. Adding capital letters makes it more secure.
    - neogodless 6y ago
      But hackers might be expecting capital letters, so disallowing them from passwords is more secure!
  - fctorial 6y ago