2 ms·

Per the Boston Globe story [0] they were actually in the process of restoring from backups but it was going too slow. Something to remember: when downtime is so

Per the Boston Globe story [0] they were actually in the process of restoring from backups but it was going too slow. Something to remember: when downtime is so critical that key pieces of a country's infrastructure is at stake, backups can't be enough-- there also has to be a rapid recovery plan to actually use them. [0]https://www.bostonglobe.com/2021/05/13/business/colonial-pipeline-paid-hackers-nearly-5-million-ransom/ https://www.bostonglobe.com/2021/05/13/business/colonial-pip...

twobitshifter 6y ago
TFA says the opposite - that backups are faster than the decryption tool supplied by the hackers. Would you run a tool supplied to you by the hackers on your network? This thing could be scrubbing, adding backdoors, really anything. >Once they received the payment, the hackers provided the operator with a decrypting tool to restore its disabled computer network. The tool was so slow that the company continued using its own backups to help restore the system, one of the people familiar with the company’s efforts said.
- ineedasername 6y ago
  Yes, that also means they had backups since the original outage but they were slow. Since they had backups they should never have paid for even slow decryption and, as you said, potential other security issues using the hackers software. So my reading of the situation is that the situation was urgent, backups were too slow, so they paid to try to have a quick fix only to have the description also be very slow. Paying might have been a complete waste of money. I could be wrong about my reading of events, but as I said originally, they lacked rapid recovery capabilities, which for something this critical is just as important as having the backups themselves.
nyczomg 6y ago
From the article you linked, it sounds like it was the other way around, but both ways to restore must be slow... “Once they received the payment, the hackers provided the operator with a decrypting tool to restore its disabled computer network. The tool was so slow that the company continued using its own backups to help restore the system, one of the people familiar with the company’s efforts said.”
- ineedasername 6y ago
  Yes, that also means they had backups since the original outage but they were also going slow. My read of the situation is that the situation was urgent, backups were too slow, so they paid to try to have a quick fix only to have that also be very slow. I could be wrong about that, but as I said originally, they lacked rapid recovery capabilities.

twobitshifter 6y ago

TFA says the opposite - that backups are faster than the decryption tool supplied by the hackers. Would you run a tool supplied to you by the hackers on your network? This thing could be scrubbing, adding backdoors, really anything. >Once they received the payment, the hackers provided the operator with a decrypting tool to restore its disabled computer network. The tool was so slow that the company continued using its own backups to help restore the system, one of the people familiar with the company’s efforts said.

ineedasername 6y ago
Yes, that also means they had backups since the original outage but they were slow. Since they had backups they should never have paid for even slow decryption and, as you said, potential other security issues using the hackers software. So my reading of the situation is that the situation was urgent, backups were too slow, so they paid to try to have a quick fix only to have the description also be very slow. Paying might have been a complete waste of money. I could be wrong about my reading of events, but as I said originally, they lacked rapid recovery capabilities, which for something this critical is just as important as having the backups themselves.

nyczomg 6y ago

From the article you linked, it sounds like it was the other way around, but both ways to restore must be slow... “Once they received the payment, the hackers provided the operator with a decrypting tool to restore its disabled computer network. The tool was so slow that the company continued using its own backups to help restore the system, one of the people familiar with the company’s efforts said.”

ineedasername 6y ago
Yes, that also means they had backups since the original outage but they were also going slow. My read of the situation is that the situation was urgent, backups were too slow, so they paid to try to have a quick fix only to have that also be very slow. I could be wrong about that, but as I said originally, they lacked rapid recovery capabilities.