3 ms·

Ask HN: What Are Your Measures Against Ransomware?

1 points by xrayarx 5y ago

xrayarx 5y ago
How is your company, how are you privately protecting yourself against ransomware? Details please!
- rolph 5y ago
  always backup your assets off platform, multiple copies, multiple media forms, multiple locations. run your machines OS booted from a non writable image. blacklist any firmware upgrade from unhardened machines.
  - nonsapreiche 5y ago
    "blacklist any firmware upgrade from unhardened machines." This is interesting, is it related to some specific OS or Bios?
    - rolph 5y ago
      supply chain attacks can consist of malicious firmware updates. any device that is subjected to frequent firmware updates has an elevated potential to be attacked and compromised at the hardware level. Firmware should be vetted as should be the supply chain, and this is the usual case. examining firmware for exploitive content is non trivial,and if you operate mission critical infrstructure you should have a probate machine to recieve suspect firmware for examination of its subsequent operation, before full deployment. routerlevel, or edge machine blockade of firmware supply domains should be default with internal distribution of probated firmware until trust is established.
znpy 5y ago
On a personal level, my data is snapshotted hourly (zfs) and backed up on a remote machine. I also have an offline machine that I turn on from time to time to sync all the data and then I turn it off again.
- ksaj 5y ago
  The second point is a good one. My workhorse desktop is rarely connected to the network. It has dual monitors, and both monitors are shared by another computer that is connected to the net. So it's easy to switch either screen from workhorse to web browser or whatever. I can't cut/paste between them, but it doesn't hurt that the sneaker net is in the same physical location and even shares the same screens. I rarely need to do that anyway. When I'm working on my laptop, I simply take what I did for the session and thumb-drive it to the workhorse later. The workhorse desktop is my "de facto" source, so it is the only one I bother backing up.
ericalexander0 5y ago
Use Active Directory? Reduce your domain admin population to zero. Use a privileged access management to enable elevation as needed. https://ericalexander.org/post/devops-and-ransomware/ https://ericalexander.org/post/devops-and-ransomware/

1 points by xrayarx 5y ago

xrayarx 5y ago

How is your company, how are you privately protecting yourself against ransomware? Details please!

rolph 5y ago
always backup your assets off platform, multiple copies, multiple media forms, multiple locations. run your machines OS booted from a non writable image. blacklist any firmware upgrade from unhardened machines.
- nonsapreiche 5y ago
  "blacklist any firmware upgrade from unhardened machines." This is interesting, is it related to some specific OS or Bios?
  - rolph 5y ago
    supply chain attacks can consist of malicious firmware updates. any device that is subjected to frequent firmware updates has an elevated potential to be attacked and compromised at the hardware level. Firmware should be vetted as should be the supply chain, and this is the usual case. examining firmware for exploitive content is non trivial,and if you operate mission critical infrstructure you should have a probate machine to recieve suspect firmware for examination of its subsequent operation, before full deployment. routerlevel, or edge machine blockade of firmware supply domains should be default with internal distribution of probated firmware until trust is established.

znpy 5y ago

On a personal level, my data is snapshotted hourly (zfs) and backed up on a remote machine. I also have an offline machine that I turn on from time to time to sync all the data and then I turn it off again.

ksaj 5y ago
The second point is a good one. My workhorse desktop is rarely connected to the network. It has dual monitors, and both monitors are shared by another computer that is connected to the net. So it's easy to switch either screen from workhorse to web browser or whatever. I can't cut/paste between them, but it doesn't hurt that the sneaker net is in the same physical location and even shares the same screens. I rarely need to do that anyway. When I'm working on my laptop, I simply take what I did for the session and thumb-drive it to the workhorse later. The workhorse desktop is my "de facto" source, so it is the only one I bother backing up.

ericalexander0 5y ago

Use Active Directory? Reduce your domain admin population to zero. Use a privileged access management to enable elevation as needed. https://ericalexander.org/post/devops-and-ransomware/ https://ericalexander.org/post/devops-and-ransomware/