3 ms·
This may be an impossible question to ask: does anybody know of organizations running entirely dark copies of infrastructure possibly using an entirely differen
by dcow 5y ago
This may be an impossible question to ask: does anybody know of organizations running entirely dark copies of infrastructure possibly using an entirely different stack up to the application layer? Rather than redundancy, which is an announced component of your infrastructure available for failover and thus known to attackers, this dark infrastructure exists unknown to all but a select few employees and can be engaged during a ransomware attack. Throw the old infrastructure away and rebuild new dark infra. I have heard at least one story of something like this earlier today when discussing this headline. Curious how common it is.
- ht85 5y agoKeeping two infras in sync means that you gotta have some kind of formalized management process. If you do have that, then there isn't much value in having the fail over up and running at all time, you can just build/launch it if needed. This is easy in a containerized env, if you don't have that luxury having batch scripts that can provision all the critical servers quickly does the trick. This combined with reliable database backups should be enough to make the impact of such an attack trivial.