4 ms·

Ask HN: What's the best way to protect a network against ransomware?

5 points by WheelsAtLarge 5y ago

chiph 5y ago
Have good off-site off-line backups. Train people not to click on random links. Have a good intrusion detection system.
- toomuchtodo 5y ago
  And perform periodic disaster recovery and restore exercises from those backups. If you don’t know the backups will restore, they’re worthless.
- litoE 5y ago
  Even if your backups are usually off-line, there must be a period of time, while you are doing a backup, that the backup system is in-line. How do you get around that?
  - chiph 5y ago
    By having multiple backups over time. The ransomware criminals will sometimes plant the code and let it sit idle, so you want to have a backup that predates that event.
kleer001 5y ago
The weakest link is always human. Dealing what that should be paramount to solve that problem.
ericalexander0 5y ago
Most ransomware attacks involve windows domains. The chain of events is usually: land a beach head (perimeter vuln or phishing), find domain admin with bloodhound or similar, steal domain admin creds with mimikatz or similar, encrypt everything. There's multiple points in that chain to address. You'll get the most leverage by reducing domain admin population size through privileged access management. Tool to help understand the problem: https://github.com/ericalexanderorg/easyhound https://github.com/ericalexanderorg/easyhound
mikewarot 5y ago
Have a physically separate network for the backups, with a data diode isolating it from production. Daily incremental backups. Weekly complete backups. If you can possibly afford it, never erase a backup. Also, every quarter or so, schedule an outage, clone the hard drives in the servers to new drives, put the old ones in storage, and run from the clones. If you have critical hardware that is running some old OS and can't be upgraded, put it on a physically separate network, and data diode, and push those backups out as well. Test the hell out of those backups, restore something from them at least once a quarter, if not more often. Start investigating capability based security and operating systems that support that model.

chiph 5y ago

Have good off-site off-line backups. Train people not to click on random links. Have a good intrusion detection system.

toomuchtodo 5y ago
And perform periodic disaster recovery and restore exercises from those backups. If you don’t know the backups will restore, they’re worthless.
litoE 5y ago
Even if your backups are usually off-line, there must be a period of time, while you are doing a backup, that the backup system is in-line. How do you get around that?
- chiph 5y ago
  By having multiple backups over time. The ransomware criminals will sometimes plant the code and let it sit idle, so you want to have a backup that predates that event.

kleer001 5y ago

The weakest link is always human. Dealing what that should be paramount to solve that problem.

ericalexander0 5y ago

Most ransomware attacks involve windows domains. The chain of events is usually: land a beach head (perimeter vuln or phishing), find domain admin with bloodhound or similar, steal domain admin creds with mimikatz or similar, encrypt everything. There's multiple points in that chain to address. You'll get the most leverage by reducing domain admin population size through privileged access management. Tool to help understand the problem: https://github.com/ericalexanderorg/easyhound https://github.com/ericalexanderorg/easyhound

mikewarot 5y ago

Have a physically separate network for the backups, with a data diode isolating it from production. Daily incremental backups. Weekly complete backups. If you can possibly afford it, never erase a backup. Also, every quarter or so, schedule an outage, clone the hard drives in the servers to new drives, put the old ones in storage, and run from the clones. If you have critical hardware that is running some old OS and can't be upgraded, put it on a physically separate network, and data diode, and push those backups out as well. Test the hell out of those backups, restore something from them at least once a quarter, if not more often. Start investigating capability based security and operating systems that support that model.