6 ms·

Complete, tested tape backups would cure many, many ills. They're out of fashion, but..

grumple 5y ago
Tape backups are ok but still mean significant operational downtime because recovery from tape is slow. This is better for long term data storage than rapid recovery. For recovery, you need more accessible backups. And to test your backup plan.
- jl6 5y ago
  High end tape reads sequentially faster than a typical spinning HDD, so it should be possible to design for rapid full restores. Rapid restores of specific files (e.g. to recover from accidental deletion) would be slow from tape though, so are probably best served by online snapshots rather than the DR backup.
- rjmunro 5y ago
  The time to restore from backups after a ransomware attack is more about figuring out how they got in and closing any back doors then cleaning out the existing systems, applying the latest security updates etc., rather than actually restoring the backups from tape or whatever. The last thing you want is for your backup to restore whatever back door they installed a few weeks before they launched the actual attack, or to leave the unpatched system (or whatever it was) open and immediately have the attackers encrypt all your files again.
xienze 5y ago
The bigger IMO problem with ransomware attacks isn't necessarily that they're holding your data hostage, it's that they can and will publish it. You might be able to tell them to kiss your ass because you have backups, but then they'll publish that information. It's a bit more of a rock-and-a-hard-place situation than most people realize.
- headmelted 5y ago
  Which if you pay the ransom, means also relying on the word of the people that are actively extorting you. Scary, scary place to be. Especially for a health service.
  - xienze 5y ago
    > Which if you pay the ransom, means also relying on the word of the people that are actively extorting you. As weird as it sounds, reputation matters for these guys. If you have a track record of taking the money and publishing data anyway, no one is ever gonna bother paying you in the first place. Why would they? Your data is gonna get published no matter what, may as well save the ransom money.
    - perl4ever 5y ago
      You can flip it around (if you're a pessimist): 1. If you *don't* pay, then you know bad things will happen. 2. So you might as well pay, regardless of their reputation, because your chances are strictly better even if they are nearly nothing. 3. Knowing that, there is no incentive for them to maintain a reputation by honoring the ransoms. This seems like a stable equilibrium.
- ransom1538 5y ago
  Eh. From my understanding the people that pay do fine. As sick as it is, these crews following through is good for business. These crews are making tons of cash. If word gets out they don't unencrypt and do publicly publish - people will just stop paying: period. Hell. Some of these crews have a help desk. [1] https://www.macworld.co.uk/cmsdata/features/3659100/how_to_remove_mac_ransomware_keranger_975_thumb.jpg https://www.macworld.co.uk/cmsdata/features/3659100/how_to_r...
  - steve_gh 5y ago
    This is a public health service. It's paid for out of taxation.
raffraffraff 5y ago
I would be amazed if the Irish health service had advanced beyond tape storage. I mean primary storage. (I'm Irish btw)

Tape backups are ok but still mean significant operational downtime because recovery from tape is slow. This is better for long term data storage than rapid recovery. For recovery, you need more accessible backups. And to test your backup plan.

jl6 5y ago
High end tape reads sequentially faster than a typical spinning HDD, so it should be possible to design for rapid full restores. Rapid restores of specific files (e.g. to recover from accidental deletion) would be slow from tape though, so are probably best served by online snapshots rather than the DR backup.
rjmunro 5y ago
The time to restore from backups after a ransomware attack is more about figuring out how they got in and closing any back doors then cleaning out the existing systems, applying the latest security updates etc., rather than actually restoring the backups from tape or whatever. The last thing you want is for your backup to restore whatever back door they installed a few weeks before they launched the actual attack, or to leave the unpatched system (or whatever it was) open and immediately have the attackers encrypt all your files again.

xienze 5y ago

The bigger IMO problem with ransomware attacks isn't necessarily that they're holding your data hostage, it's that they can and will publish it. You might be able to tell them to kiss your ass because you have backups, but then they'll publish that information. It's a bit more of a rock-and-a-hard-place situation than most people realize.

headmelted 5y ago
Which if you pay the ransom, means also relying on the word of the people that are actively extorting you. Scary, scary place to be. Especially for a health service.
- xienze 5y ago
  > Which if you pay the ransom, means also relying on the word of the people that are actively extorting you. As weird as it sounds, reputation matters for these guys. If you have a track record of taking the money and publishing data anyway, no one is ever gonna bother paying you in the first place. Why would they? Your data is gonna get published no matter what, may as well save the ransom money.
  - perl4ever 5y ago
    You can flip it around (if you're a pessimist): 1. If you *don't* pay, then you know bad things will happen. 2. So you might as well pay, regardless of their reputation, because your chances are strictly better even if they are nearly nothing. 3. Knowing that, there is no incentive for them to maintain a reputation by honoring the ransoms. This seems like a stable equilibrium.
ransom1538 5y ago
Eh. From my understanding the people that pay do fine. As sick as it is, these crews following through is good for business. These crews are making tons of cash. If word gets out they don't unencrypt and do publicly publish - people will just stop paying: period. Hell. Some of these crews have a help desk. [1] https://www.macworld.co.uk/cmsdata/features/3659100/how_to_remove_mac_ransomware_keranger_975_thumb.jpg https://www.macworld.co.uk/cmsdata/features/3659100/how_to_r...
- steve_gh 5y ago
  This is a public health service. It's paid for out of taxation.

raffraffraff 5y ago

I would be amazed if the Irish health service had advanced beyond tape storage. I mean primary storage. (I'm Irish btw)