5 ms·

If only organizations would backup their own data. Then they could just restore and avoid paying. I have a backup device of my own at home and that's the one

If only organizations would backup their own data. Then they could just restore and avoid paying. I have a backup device of my own at home and that's the one I have to use. The company I work relies on some MSFT service that is pretty inflexible and won't back up the entire machine.

smsm42 5y ago
Backup is only part of the picture, one needs a proper disaster recovery strategy that is tested and updated. Otherwise it could turn out that backups exist, but it'd take half a year to bootstrap the company back into function using them. Backing up and restoring one PC is trivial, doing the same to 10000 PCs and another 1000 of interconnected software systems is a whole different business.
wrycoder 5y ago
Many people’s backup routines aren’t good enough. Some of these guys encrypt over a period of time which is long enough to exceed the backup rotation. Their code decrypts on request, until the trigger day, when it posts the banners and deletes itself.
- WalterBright 5y ago
  That's why you have a combination of rotating backups, say 7, one a day, and non-rotating permanent backups, say once a week. Also, one should use "append only" backups (such as tape), or a disk drive designed to be append only with hardware write enables.
  - wrycoder 5y ago
    With a de-duplicating backup system like Borg, you can keep more backups in the same space. borgbase.com provides append-only and 2FA, which keeps your backups secure.
- dheera 5y ago
  Maybe corporations should make it standard practice to have cold storage backups that are physically disconnected from the network (by humans) in a rotated fashion. Backup A is physically disconnected on B days and backup B is physically disconnected on A days.
  - sreitshamer 5y ago
    Or stored an a cloud storage provider that supports S3-style object lock.
paulryanrogers 5y ago
There is also the threat of leaking private data. Companies which collect PII could be liable if it's proven they were negligent.
btilly 5y ago
If only organizations would backup their own data. Then they could just restore and avoid paying. This is commonly suggested, and entirely useless. What the ransomware groups do is put a time bomb on the computer, then leave it to trigger on a future condition. Your backup will backup the time bomb, and the second you restore it, it also goes boom. And therefore your backup is a perfect copy of your data but entirely useless.
- Schinken_ 5y ago
  One should still be able to just mount the disk and not boot the OS associated to browse through the files? Not fully automated but at least some solution and maybe worthwhile for smaller businesses
- NilsIRL 5y ago
  This is not entirely useless as you still have a backup of the data, you just need to restore it without the "time bomb".
  - btilly 5y ago
    Good luck finding the time bomb. See also my above comments about ways that they can corrupt data.
- Frost1x 5y ago
  That assumes the backup couples the data and compute together, like a system image or something. If the backup is just data and is somewhere else, you can just rebuild the compute infrastructure from a known secure state (which arguably may require rebuilding the entire compute environment). Even if your backup does couple the data and compute together, if it's simply time based (not sure what other event you could use really, perhaps some pure probabilistic function), then it seems like you can just trick the environment that the time is something else to get back in. The real underpinning issue is that this stuff breaks the state of the infrastructure and the business can't afford the downtime to go around and repair these issues. If you have your infrastructure build out mostly automated, that automation is backed up, and critical data is backed up, then you can reasonably sidestep these issues (I supposed a real thorough breach might integrate the ransomware in this very automation system but it should be reasonable to root out). The other issue is of course if the intruders threaten to release private data (empkoyee and customer PII, financials, so on). There's also business integrity but that doesn't really seem to matter anymore.
gentleman11 5y ago
How do you go about testing your personal backups? I find my own desktop is harder to verify than a server with automated tests
- WalterBright 5y ago
  What I do is see if it can be read by an independent system. For example, many dvd players can read media files plugged into a USB port. Put some media files on your backup drive, and see if your dvd player can read them.
denton-scratch 5y ago
You have to have backup. You can't trust professional crooks, because - well - they're crooks. If you are penetrated, it's not so easy as just restoring your data from backup. You have to sterilise the machines you are restoring to. And you have to sterilise the data you want to restore. CM automation can deal with the system sterlisation, but I don't know how to sterilise data without using human judgement. Don't get penetrated.

smsm42 5y ago

Backup is only part of the picture, one needs a proper disaster recovery strategy that is tested and updated. Otherwise it could turn out that backups exist, but it'd take half a year to bootstrap the company back into function using them. Backing up and restoring one PC is trivial, doing the same to 10000 PCs and another 1000 of interconnected software systems is a whole different business.

wrycoder 5y ago

Many people’s backup routines aren’t good enough. Some of these guys encrypt over a period of time which is long enough to exceed the backup rotation. Their code decrypts on request, until the trigger day, when it posts the banners and deletes itself.

WalterBright 5y ago
That's why you have a combination of rotating backups, say 7, one a day, and non-rotating permanent backups, say once a week. Also, one should use "append only" backups (such as tape), or a disk drive designed to be append only with hardware write enables.
- wrycoder 5y ago
  With a de-duplicating backup system like Borg, you can keep more backups in the same space. borgbase.com provides append-only and 2FA, which keeps your backups secure.
dheera 5y ago
Maybe corporations should make it standard practice to have cold storage backups that are physically disconnected from the network (by humans) in a rotated fashion. Backup A is physically disconnected on B days and backup B is physically disconnected on A days.
- sreitshamer 5y ago
  Or stored an a cloud storage provider that supports S3-style object lock.

paulryanrogers 5y ago

There is also the threat of leaking private data. Companies which collect PII could be liable if it's proven they were negligent.

btilly 5y ago

If only organizations would backup their own data. Then they could just restore and avoid paying. This is commonly suggested, and entirely useless. What the ransomware groups do is put a time bomb on the computer, then leave it to trigger on a future condition. Your backup will backup the time bomb, and the second you restore it, it also goes boom. And therefore your backup is a perfect copy of your data but entirely useless.

Schinken_ 5y ago
One should still be able to just mount the disk and not boot the OS associated to browse through the files? Not fully automated but at least some solution and maybe worthwhile for smaller businesses
NilsIRL 5y ago
This is not entirely useless as you still have a backup of the data, you just need to restore it without the "time bomb".
- btilly 5y ago
  Good luck finding the time bomb. See also my above comments about ways that they can corrupt data.
Frost1x 5y ago
That assumes the backup couples the data and compute together, like a system image or something. If the backup is just data and is somewhere else, you can just rebuild the compute infrastructure from a known secure state (which arguably may require rebuilding the entire compute environment). Even if your backup does couple the data and compute together, if it's simply time based (not sure what other event you could use really, perhaps some pure probabilistic function), then it seems like you can just trick the environment that the time is something else to get back in. The real underpinning issue is that this stuff breaks the state of the infrastructure and the business can't afford the downtime to go around and repair these issues. If you have your infrastructure build out mostly automated, that automation is backed up, and critical data is backed up, then you can reasonably sidestep these issues (I supposed a real thorough breach might integrate the ransomware in this very automation system but it should be reasonable to root out). The other issue is of course if the intruders threaten to release private data (empkoyee and customer PII, financials, so on). There's also business integrity but that doesn't really seem to matter anymore.

gentleman11 5y ago

How do you go about testing your personal backups? I find my own desktop is harder to verify than a server with automated tests

WalterBright 5y ago
What I do is see if it can be read by an independent system. For example, many dvd players can read media files plugged into a USB port. Put some media files on your backup drive, and see if your dvd player can read them.

denton-scratch 5y ago

You have to have backup. You can't trust professional crooks, because - well - they're crooks. If you are penetrated, it's not so easy as just restoring your data from backup. You have to sterilise the machines you are restoring to. And you have to sterilise the data you want to restore. CM automation can deal with the system sterlisation, but I don't know how to sterilise data without using human judgement. Don't get penetrated.