9 ms·

What I suspect: the first ransom was paid by insurance, therefore it didn't hurt them, therefore they didn't bother protect themselves for the second. Now just

What I suspect: the first ransom was paid by insurance, therefore it didn't hurt them, therefore they didn't bother protect themselves for the second. Now just wait to see what will happen to your insurance rate after you pay the third ransom. They certainly will begin to understand the need for backups.

SV_BubbleTime 5y ago
Most of these start as phishes to lower level employees. It makes sense to me that’ll happen again and I’m not sure I can say the solution is better backups. Another issue with backups, is are you restoring to an already infected / immediately infectable state? I think the better closer is “The certainly will begin to take security, training, and best practices seriously”.
- ryanmcbride 5y ago
  I'd like to think security training can take care of it, that people can be careful and considerate and have a skeptical eye about every single message they receive. But it only takes one person and these huge companies employ so many people. So many times, even at companies with really strict security training I've seen people just walk away from their unlocked computers, click random links in emails, stuff like that. People are always the first line of defense but it's one of those one-sided battles, where every single person in the entire company has to make 0 mistakes, and an attacker only has to get lucky once.
  - spicybright 5y ago
    Which is why you need a level above the individual to protet from attacks. It sucks locking things down for each employee, and subjecting them to bureaucracy to unlock things they need to do, but it's better than ransomware. It's unrealistic to expect every employee to catch hacking attempts 100% of the time.
  - WalterBright 5y ago
    A single computer should never have access to all the company's data. Neither should a single login. It's like compartmentalization on a battleship. A single hole won't sink it, in fact, many holes won't.
    - hobs 5y ago
      Most people's enterprise software is akin to an already waterlogged dingy.
  - lurquer 5y ago
    > where every single person in the entire company has to make 0 mistakes, and an attacker only has to get lucky once Good post. I don’t mean this criticism for you specifically. But, why is there an assumption among HN types that there are no bad-actors among the insiders? You can have all the safeguards you want, but if an insider deliberately installs something, you’re screwed. In some industries — armored trucks, banks, military stuff — there is a huge emphasis on background checks, security clearances, and the like to weed out bad actors. (And, even then, it often fails.) I sense there is nothing similar for employees handling the company’s data. Obviously, there might be background checks and the like — hell, McDonalds has background checks. But, I’m not aware of the intensive FBI-style screening you see in the aforementioned realms. Am I wrong? How many thousands of people, for instance, could corrupt or lock the data at, say, Amazon? Are these people scrutinized to the same level as standard Brinks Armored Truck driver? I doubt it.
    - squiggleblaz 5y ago
      I guess there's two questions: - is protecting against internal sabotage actually different that protecting against external attack. I don't think it's all that different. It comes down to authenticating actions and enforcing the principle of least privilege. If you built a system that was actually secure (i.e. one that depends on reasonable inconveniences, rather than one that depends on people to be perfect all the time or is so inconvenient it inclines them to do the digital equivalent of jamming the door open) it is likely that it will be secure enough against most internal saboteurs. - is protecting against internal sabotage going to pay off? Most people probably aren't inclined to deliberately target their own company. It's far more likely that there is a bad actor in the world who wants to target your company, than that there is in your company. And making a person's job secure less stable is probably going to make them more likely to be a saboteur, so you should carefully evaluate whether gratuitously adding stress to someone who might get behind on their mortgage is a good idea. (Which I suppose is what this kind of background check would cause.)
      - ipaddr 5y ago
        Malware comes from the outside. Stealing company secrets and selling them is what I would be worried about from internal threats. Either way least access necessarily where possible is a good strategy.
  - sandworm101 5y ago
    >> But it only takes one person and these huge companies employ so many people. No. It never takes only one employ clicking a bad link. It takes that click, plus a browser/email/os system that allow for random code to executed. It take an IT department that has allowed individual non-IT employees to use computers with elevated privileges. It requires a management structure that has failed to invest in proper off-site/cold backups. It requires an organization that doesn't have a proper business continuity plan. And at the top of the incompetency pyramid, it requires a vendor that sells an email system that allows evil email messages to somehow infect entire operating systems. Want your email to connect to your office suite? Sure. Want to install random software based on clicked links? Sure thing. Want to update your firewall, install a new browsers and simultaneously backup all your encryption keys to a random server in the far east? Why not! Anything to make your operating system experience seamless.
    - ryanmcbride 5y ago
      that's what I'm saying. Just training isn't enough the system has to be hardened.
    - bluGill 5y ago
      Notice the previous comment about developers not allowed to be admin of their own machines? On computers with a good security model developers don't need to be admin of their own machines, but that wasn't thought of.
      - mcny 5y ago
        I don’t get the point of not allowing administrator to the local machine to employees. The local machine is practically a throwaway in my opinion. Why should we care about it? The shared folder is much more vital to the business.
        ryanmcbride 5y ago
        Yeah anytime a job locks admin access to a local machine I assume their network security is full of holes, and I'm usually right about that assumption.
  - everdrive 5y ago
    I genuinely don't put any faith in education. Every phishing education program I've seen has effectively said "look out for weird emails, (perhaps with misspellings) and if you see them report them to security!" I haven't seen any which went into the real specifics which might actually educate users: - A phishing email which can pwn you without user interaction is basically unheard of. - Even malicious sites generally can't do anything bad simply by visiting them. (and yes, I'm aware browser exploitation exists, but it is exceedingly rare) - Ultimately, it's entering your credentials in a malicious site which is what puts users at risk. A user must click a malicious link (sometimes two) and then intentionally enter their credentials into the malicious site. Between this, and the fact that users must read emails, visit sites, and enter their credentials over and over, just to get through their workday, I believe the outcome is that user education doesn't amount to much. It would be much better if a normal user's workflow didn't usually require clicking on email links and then entering their credentials. The fact that this is required means that even a savvy users will eventually be tired / rushed / working on automatic and get owned.
    - carlosf 5y ago
      Which is why basic stuff like MFA and MDM (block sign-ins coming from non compliant devices) works wonders against ransomware attacks.
    - dcow 5y ago
      Can't wait for WebAuthN to proliferate.
    - shakna 5y ago
      > A phishing email which can pwn you without user interaction is basically unheard of. If you extend from "email" to the other communication tools that companies use today (and do use for inter-company communications too), there actually have been a number of these in the past year. Outlook [3] had one that didn't require downloading the file, exactly - the "Preview" window from just clicking the attachment once, was enough. Microsoft Teams [0], Jabber [1] and Slack [2] were all hit by real 0-interaction RCEs. [0] https://github.com/oskarsve/ms-teams-rce/blob/main/README.md https://github.com/oskarsve/ms-teams-rce/blob/main/README.md [1] https://nvd.nist.gov/vuln/detail/CVE-2020-3495 https://nvd.nist.gov/vuln/detail/CVE-2020-3495 [2] https://hackerone.com/reports/783877 https://hackerone.com/reports/783877 [3] https://nvd.nist.gov/vuln/detail/CVE-2020-1349 https://nvd.nist.gov/vuln/detail/CVE-2020-1349
- ajsnigrutin 5y ago
  > Most of these start as phishes to lower level employees. It makes sense to me that’ll happen again and I’m not sure I can say the solution is better backups. Why? Secretary gets a call from a nigerian prince, starts that letter.exe she gets in her e-mail, her computer gets fscked, IT takes her drive, restores a clean image, and she gets back to work. If the only copy of some important document is on his/her pc, or that pc can overwrite/delete the only copy, then they've fscked up by design... and yes, now better backups would help.
- deleted 5y ago
  [deleted]
- hellbannedguy 5y ago
  And let's not discount the moral of low paid, overworked employees, and companies that let low level managers run roughshod over lower level employees. My point is don't discount inside corporate espionage by disgruntled any level employees. Thank goodness I didn't have access to a script that would lock up at least two of my past employers when coming up years ago? Then again, I personally haven't been that mad, but boy do I know employees who were. I could say that we are all choir boys, but you piss on an employee, especially during a recession, well let's just say I have seen unpstanding guys rub magnets over hard drives over pure apathy. (The guy didn't know about strength of magnents, and it did not hurt anything.) Plugging in a usb, or downloading a suspicious email is something I can see happening, especially to "those" companies. I imagine Xfinity employees dream about it?
  - gerdesj 5y ago
    "I have seen unpstanding guys rub magnets over hard drives over pure apathy." Open up a spinning rust hard drive and you will find two very strong magnets inside, positioned opposite each other.
    - XorNot 5y ago
      This isn't why it didn't work though: disks tolerate smooth magnetic field gradients just fine. To wipe them you want a chaotic, noisy electromagnet.
      - exikyut 5y ago
        Wow, interesting. How does that work?!
        XorNot 5y ago
        Basically it's the transition in field strength, not the field, which flips a bit. So you need a moving magnetic field, and you need to cause a lot of changes because HDDs have all sorts of error correction.
  - 5y ago
- PeterisP 5y ago
  There are many steps in the chain between a phish message and a ransomware attack - the user opening a phish is just one of them. You might prevent lateral movement afterwards, you may detect the attack in time (there often are days or even weeks between the phish and the ransom) to protect it, you might prevent the payload from reaching the user, etc. So yes, you're right, the solution is not just better backups but stepping up the whole security game - however that takes will, money and quite some time.
  - x86_64Ubuntu 5y ago
    >... however that takes will, money and quite some time. And the accounting folks will not be fans of anything that costs money. They will just say "But we haven't been attacked a second time, why should we pay for mitigation services and implementations??"
    - PeterisP 5y ago
      That's the "it takes will" part. Organizations can and do take many decisions of which "the accounting folks" are not fans of, the accounting people can and do say such things about the costs, but they don't have a veto. Arguments about cost of mitigation are valid in general, but leaders and owners can choose the priorities, and the responsibility and blame for these choices is fully on them (for their will or lack of will), not on "the accounting folks" arguments. Also, sometimes that accounting argument is entirely valid. For example, look at the recent case of First American Financial - https://krebsonsecurity.com/2021/06/first-american-financial-pays-farcical-500k-fine/ https://krebsonsecurity.com/2021/06/first-american-financial... - if the consequence of leaking the sensitive financial documents of millions of customers is just 500k, then it definitely is cheaper to just accept the hacks and pay the compensation, because investing in proper security would be much more expensive than that.
- hnick 5y ago
  Backups might get you up and running again, but the new hotness is threatening to release trade secrets, competitive advantages, and embarrassing emails. Even with an ironclad recovery some people might be inclined to pay in such a situation.
  - bluGill 5y ago
    True, but companies may be less likely to pay. I'm confident that our major competitors have enough ethics to not look at our trade secrets if released, and the minor ones that would don't have the ability to hide their tracks and so in court they will be shut down.
- beermonster 5y ago
  > Most of these start as phishes to lower level employees. They used to (and probably still) do this. But more recently these folk are paying access brokers. A bit like bank robbers teaming up with criminal locksmiths. > It makes sense to me that’ll happen again and I’m not sure I can say the solution is better backups. You'll ideally need: - Better security awareness training to cover human weakness such as spotting dodgy email and what to do if you click a link - Patch vulnerabilities quickly as this will reduce risk considerably - Company wide tested and sufficient backup strategy (most companies fail on this) to protect key identified data assets - Regularly pen-test both your internal and external environments Obviously it doesn't stop there, but those are key.
dangerboysteve 5y ago
Or they overhauled the IT team.
- hanniabu 5y ago
  I'd say chances are somebody brought up concerns at most of these places but management told them not to worry for one reason or another.
failwhaleshark 5y ago
Untested backups and DR/BCP procedures aren't backups. Snapshots aren't backups. Backups that aren't physically-isolated, typically offsite, aren't backups.
- bottled_poe 5y ago
  Well then, It’s starting to sound like backups aren’t what a business needs.
  - des1nderlase 5y ago
    Backups are there to provide a business continuity in wide range of disruptions. What you want to protect your business from is up to you, but typically you need protection from all things OP mentioned.
    - VendorManager 5y ago
      Backups and disaster recovery sites are definitely important from business continuity perspective, but there is a bigger risk of leaking PII and other sensitive information such as SIN / Social security numbers if the software vendor has access to it. Your business might be able to recover from backup if the hacker has not encrypted it, but the hacker for sure will be maliciously using the PII information to send phishing emails.
      - failwhaleshark 5y ago
        These are somewhat orthogonal issues. 1. Test and encrypt backups. 2. Don't get hacked. Defense-in-depth philosophy and rigorous, routine social-engineering training/testing. If you get hacked, it's usually game over. Defend systems like the business depends on it because it does. 3. Limit exfil: extra security for PII, exfil detection, and [HN]I[DP]S.
- etherael 5y ago
  Why are offsite write only continuously incremental snapshots from a full start not backups?
VendorManager 5y ago
The insurance cost is increasing due to rising ransomware attacks. This is causing a lot of stress within insurance companies and insured companies. An HBR post cited that this is a new niche for insurance companies and 5 big ransom demands can wipe out the insurance premium they collected from 250 customers. Relevant analysis here: http://www.vendormanagementoffice.net/2021/06/cyber-insurance-price-going-up-should.html http://www.vendormanagementoffice.net/2021/06/cyber-insuranc...

SV_BubbleTime 5y ago

Most of these start as phishes to lower level employees. It makes sense to me that’ll happen again and I’m not sure I can say the solution is better backups. Another issue with backups, is are you restoring to an already infected / immediately infectable state? I think the better closer is “The certainly will begin to take security, training, and best practices seriously”.

ryanmcbride 5y ago
I'd like to think security training can take care of it, that people can be careful and considerate and have a skeptical eye about every single message they receive. But it only takes one person and these huge companies employ so many people. So many times, even at companies with really strict security training I've seen people just walk away from their unlocked computers, click random links in emails, stuff like that. People are always the first line of defense but it's one of those one-sided battles, where every single person in the entire company has to make 0 mistakes, and an attacker only has to get lucky once.
- spicybright 5y ago
  Which is why you need a level above the individual to protet from attacks. It sucks locking things down for each employee, and subjecting them to bureaucracy to unlock things they need to do, but it's better than ransomware. It's unrealistic to expect every employee to catch hacking attempts 100% of the time.
- WalterBright 5y ago
  A single computer should never have access to all the company's data. Neither should a single login. It's like compartmentalization on a battleship. A single hole won't sink it, in fact, many holes won't.
  - hobs 5y ago
    Most people's enterprise software is akin to an already waterlogged dingy.
- lurquer 5y ago
  > where every single person in the entire company has to make 0 mistakes, and an attacker only has to get lucky once Good post. I don’t mean this criticism for you specifically. But, why is there an assumption among HN types that there are no bad-actors among the insiders? You can have all the safeguards you want, but if an insider deliberately installs something, you’re screwed. In some industries — armored trucks, banks, military stuff — there is a huge emphasis on background checks, security clearances, and the like to weed out bad actors. (And, even then, it often fails.) I sense there is nothing similar for employees handling the company’s data. Obviously, there might be background checks and the like — hell, McDonalds has background checks. But, I’m not aware of the intensive FBI-style screening you see in the aforementioned realms. Am I wrong? How many thousands of people, for instance, could corrupt or lock the data at, say, Amazon? Are these people scrutinized to the same level as standard Brinks Armored Truck driver? I doubt it.
  - squiggleblaz 5y ago
    I guess there's two questions: - is protecting against internal sabotage actually different that protecting against external attack. I don't think it's all that different. It comes down to authenticating actions and enforcing the principle of least privilege. If you built a system that was actually secure (i.e. one that depends on reasonable inconveniences, rather than one that depends on people to be perfect all the time or is so inconvenient it inclines them to do the digital equivalent of jamming the door open) it is likely that it will be secure enough against most internal saboteurs. - is protecting against internal sabotage going to pay off? Most people probably aren't inclined to deliberately target their own company. It's far more likely that there is a bad actor in the world who wants to target your company, than that there is in your company. And making a person's job secure less stable is probably going to make them more likely to be a saboteur, so you should carefully evaluate whether gratuitously adding stress to someone who might get behind on their mortgage is a good idea. (Which I suppose is what this kind of background check would cause.)
    - ipaddr 5y ago
      Malware comes from the outside. Stealing company secrets and selling them is what I would be worried about from internal threats. Either way least access necessarily where possible is a good strategy.
- sandworm101 5y ago
  >> But it only takes one person and these huge companies employ so many people. No. It never takes only one employ clicking a bad link. It takes that click, plus a browser/email/os system that allow for random code to executed. It take an IT department that has allowed individual non-IT employees to use computers with elevated privileges. It requires a management structure that has failed to invest in proper off-site/cold backups. It requires an organization that doesn't have a proper business continuity plan. And at the top of the incompetency pyramid, it requires a vendor that sells an email system that allows evil email messages to somehow infect entire operating systems. Want your email to connect to your office suite? Sure. Want to install random software based on clicked links? Sure thing. Want to update your firewall, install a new browsers and simultaneously backup all your encryption keys to a random server in the far east? Why not! Anything to make your operating system experience seamless.
  - ryanmcbride 5y ago
    that's what I'm saying. Just training isn't enough the system has to be hardened.
  - bluGill 5y ago
    Notice the previous comment about developers not allowed to be admin of their own machines? On computers with a good security model developers don't need to be admin of their own machines, but that wasn't thought of.
    - mcny 5y ago
      I don’t get the point of not allowing administrator to the local machine to employees. The local machine is practically a throwaway in my opinion. Why should we care about it? The shared folder is much more vital to the business.
      - ryanmcbride 5y ago
        Yeah anytime a job locks admin access to a local machine I assume their network security is full of holes, and I'm usually right about that assumption.
- everdrive 5y ago
  I genuinely don't put any faith in education. Every phishing education program I've seen has effectively said "look out for weird emails, (perhaps with misspellings) and if you see them report them to security!" I haven't seen any which went into the real specifics which might actually educate users: - A phishing email which can pwn you without user interaction is basically unheard of. - Even malicious sites generally can't do anything bad simply by visiting them. (and yes, I'm aware browser exploitation exists, but it is exceedingly rare) - Ultimately, it's entering your credentials in a malicious site which is what puts users at risk. A user must click a malicious link (sometimes two) and then intentionally enter their credentials into the malicious site. Between this, and the fact that users must read emails, visit sites, and enter their credentials over and over, just to get through their workday, I believe the outcome is that user education doesn't amount to much. It would be much better if a normal user's workflow didn't usually require clicking on email links and then entering their credentials. The fact that this is required means that even a savvy users will eventually be tired / rushed / working on automatic and get owned.
  - carlosf 5y ago
    Which is why basic stuff like MFA and MDM (block sign-ins coming from non compliant devices) works wonders against ransomware attacks.
  - dcow 5y ago
    Can't wait for WebAuthN to proliferate.
  - shakna 5y ago
    > A phishing email which can pwn you without user interaction is basically unheard of. If you extend from "email" to the other communication tools that companies use today (and do use for inter-company communications too), there actually have been a number of these in the past year. Outlook [3] had one that didn't require downloading the file, exactly - the "Preview" window from just clicking the attachment once, was enough. Microsoft Teams [0], Jabber [1] and Slack [2] were all hit by real 0-interaction RCEs. [0] https://github.com/oskarsve/ms-teams-rce/blob/main/README.md https://github.com/oskarsve/ms-teams-rce/blob/main/README.md [1] https://nvd.nist.gov/vuln/detail/CVE-2020-3495 https://nvd.nist.gov/vuln/detail/CVE-2020-3495 [2] https://hackerone.com/reports/783877 https://hackerone.com/reports/783877 [3] https://nvd.nist.gov/vuln/detail/CVE-2020-1349 https://nvd.nist.gov/vuln/detail/CVE-2020-1349
ajsnigrutin 5y ago
> Most of these start as phishes to lower level employees. It makes sense to me that’ll happen again and I’m not sure I can say the solution is better backups. Why? Secretary gets a call from a nigerian prince, starts that letter.exe she gets in her e-mail, her computer gets fscked, IT takes her drive, restores a clean image, and she gets back to work. If the only copy of some important document is on his/her pc, or that pc can overwrite/delete the only copy, then they've fscked up by design... and yes, now better backups would help.
deleted 5y ago
[deleted]
hellbannedguy 5y ago
And let's not discount the moral of low paid, overworked employees, and companies that let low level managers run roughshod over lower level employees. My point is don't discount inside corporate espionage by disgruntled any level employees. Thank goodness I didn't have access to a script that would lock up at least two of my past employers when coming up years ago? Then again, I personally haven't been that mad, but boy do I know employees who were. I could say that we are all choir boys, but you piss on an employee, especially during a recession, well let's just say I have seen unpstanding guys rub magnets over hard drives over pure apathy. (The guy didn't know about strength of magnents, and it did not hurt anything.) Plugging in a usb, or downloading a suspicious email is something I can see happening, especially to "those" companies. I imagine Xfinity employees dream about it?
- gerdesj 5y ago
  "I have seen unpstanding guys rub magnets over hard drives over pure apathy." Open up a spinning rust hard drive and you will find two very strong magnets inside, positioned opposite each other.
  - XorNot 5y ago
    This isn't why it didn't work though: disks tolerate smooth magnetic field gradients just fine. To wipe them you want a chaotic, noisy electromagnet.
    - exikyut 5y ago
      Wow, interesting. How does that work?!
      - XorNot 5y ago
        Basically it's the transition in field strength, not the field, which flips a bit. So you need a moving magnetic field, and you need to cause a lot of changes because HDDs have all sorts of error correction.
- 5y ago
PeterisP 5y ago
There are many steps in the chain between a phish message and a ransomware attack - the user opening a phish is just one of them. You might prevent lateral movement afterwards, you may detect the attack in time (there often are days or even weeks between the phish and the ransom) to protect it, you might prevent the payload from reaching the user, etc. So yes, you're right, the solution is not just better backups but stepping up the whole security game - however that takes will, money and quite some time.
- x86_64Ubuntu 5y ago
  >... however that takes will, money and quite some time. And the accounting folks will not be fans of anything that costs money. They will just say "But we haven't been attacked a second time, why should we pay for mitigation services and implementations??"
  - PeterisP 5y ago
    That's the "it takes will" part. Organizations can and do take many decisions of which "the accounting folks" are not fans of, the accounting people can and do say such things about the costs, but they don't have a veto. Arguments about cost of mitigation are valid in general, but leaders and owners can choose the priorities, and the responsibility and blame for these choices is fully on them (for their will or lack of will), not on "the accounting folks" arguments. Also, sometimes that accounting argument is entirely valid. For example, look at the recent case of First American Financial - https://krebsonsecurity.com/2021/06/first-american-financial-pays-farcical-500k-fine/ https://krebsonsecurity.com/2021/06/first-american-financial... - if the consequence of leaking the sensitive financial documents of millions of customers is just 500k, then it definitely is cheaper to just accept the hacks and pay the compensation, because investing in proper security would be much more expensive than that.
hnick 5y ago
Backups might get you up and running again, but the new hotness is threatening to release trade secrets, competitive advantages, and embarrassing emails. Even with an ironclad recovery some people might be inclined to pay in such a situation.
- bluGill 5y ago
  True, but companies may be less likely to pay. I'm confident that our major competitors have enough ethics to not look at our trade secrets if released, and the minor ones that would don't have the ability to hide their tracks and so in court they will be shut down.
beermonster 5y ago
> Most of these start as phishes to lower level employees. They used to (and probably still) do this. But more recently these folk are paying access brokers. A bit like bank robbers teaming up with criminal locksmiths. > It makes sense to me that’ll happen again and I’m not sure I can say the solution is better backups. You'll ideally need: - Better security awareness training to cover human weakness such as spotting dodgy email and what to do if you click a link - Patch vulnerabilities quickly as this will reduce risk considerably - Company wide tested and sufficient backup strategy (most companies fail on this) to protect key identified data assets - Regularly pen-test both your internal and external environments Obviously it doesn't stop there, but those are key.

dangerboysteve 5y ago

Or they overhauled the IT team.

hanniabu 5y ago
I'd say chances are somebody brought up concerns at most of these places but management told them not to worry for one reason or another.

failwhaleshark 5y ago

Untested backups and DR/BCP procedures aren't backups. Snapshots aren't backups. Backups that aren't physically-isolated, typically offsite, aren't backups.

bottled_poe 5y ago
Well then, It’s starting to sound like backups aren’t what a business needs.
- des1nderlase 5y ago
  Backups are there to provide a business continuity in wide range of disruptions. What you want to protect your business from is up to you, but typically you need protection from all things OP mentioned.
  - VendorManager 5y ago
    Backups and disaster recovery sites are definitely important from business continuity perspective, but there is a bigger risk of leaking PII and other sensitive information such as SIN / Social security numbers if the software vendor has access to it. Your business might be able to recover from backup if the hacker has not encrypted it, but the hacker for sure will be maliciously using the PII information to send phishing emails.
    - failwhaleshark 5y ago
      These are somewhat orthogonal issues. 1. Test and encrypt backups. 2. Don't get hacked. Defense-in-depth philosophy and rigorous, routine social-engineering training/testing. If you get hacked, it's usually game over. Defend systems like the business depends on it because it does. 3. Limit exfil: extra security for PII, exfil detection, and [HN]I[DP]S.
etherael 5y ago
Why are offsite write only continuously incremental snapshots from a full start not backups?

VendorManager 5y ago

The insurance cost is increasing due to rising ransomware attacks. This is causing a lot of stress within insurance companies and insured companies. An HBR post cited that this is a new niche for insurance companies and 5 big ransom demands can wipe out the insurance premium they collected from 250 customers. Relevant analysis here: http://www.vendormanagementoffice.net/2021/06/cyber-insurance-price-going-up-should.html http://www.vendormanagementoffice.net/2021/06/cyber-insuranc...