3 ms·
Ransomware: Paying up won't stop you from getting hit again
- AtlasBarfed 5y agoA ransomware event should prompt a very thorough disaster recovery project. Probably with a dry run. Ransomware is basically a software disaster event. Disaster recovery is a famously ignored planning event. Probably because most orgs just push it down to projects and say "plan for it" and maybe sign some contracts with offsite storage companies and provide no other architectural support. Strangely, the same management pattern is repeated on enterprise security. Hire some spreadsheet managers with security credentials to "craft policy" and then push it down to funding starved projects to implement, but don't bother with providing useful solutions. Ransomware may do some good to the overall practice of IT management by reprioritizing disaster recovery.
- LinuxBender 5y agoAgreed. I would add that both the local and DR backups should be verified tamper-proof. All too often I have seen people go through all the trouble of setting up and testing DR sites, only to have the same automation able to tamper with local and DR copies of the customer data. If the automation can delete or write to a backup, so can the attackers.