3 ms·

There is another approach. Scrub old data you don't need. 2-3 year email retention on corp email. Paper files for sensitive client info (or don't keep it). W

There is another approach. Scrub old data you don't need. 2-3 year email retention on corp email. Paper files for sensitive client info (or don't keep it). We can reinstall office / windows / active director etc. Mandatory 2FA on google suite? Git codebases on github etc for LOB apps (we can rebuild and redeploy). We use the lock features in S3 for copies of data that must be kept. Not sure I can even unlock to delete as account owner without waiting for timeouts.

orf 5y ago
You can also enable versioning and deny all s3:DeleteObject actions via the bucket policy. It won’t stop a root account compromise unless you’ve got a multi-account setup going (as they could edit the bucket policy). But if you’ve not got any monitoring, they could also just remove the lock on the objects without you noticing and wait for the timeout themselves.
TrueDuality 5y ago
A lot of sensitive data is legally required to be kept around for much longer than that (email is up to 15 years if you're a publicly traded company). Most of the remaining suggestions aren't relevant to ransomware even if they're otherwise mostly fine recommendations. 2FA won't stop ransomware, or data destruction. Redeploying code and reinstalling active directory doesn't restore customer or user databases. Paper files are not accessible when they're needed, are easily damaged or misplaced, and cost a lot to store and index (if you're referring to keeping them as backups then yes you're making a form of the argument of the post just in a very expensive and inconvenient way). Read-only S3 copies are almost certainly falling in the realm of backups... but is also a relatively expensive way to do it for most organizations larger than a start-up. Offline and offsite backups are the cheapest, most effective tool for keeping copies of your data in your companies possession due to unforeseen circumstances and they protect against a huge number of potential events beyond just ransomware. It's negligent IMO for executive officers of a company to not have invested in a solid, tested, and comprehensive backup solution.
- allset_ 5y ago
  Most attack campaigns start with compromised credentials, so MFA absolutely helps prevent ransomware.
  - corty 5y ago
    Only about half. The rest is through emailed trojans and RCE bugs.
  - TrueDuality 5y ago
    The two most common attack campaigns are drive-by malware infections done through phishing links and infections via compromised documents. Neither of which involve credentials. Attacks involving credential stealing almost never involve malware. Source: The 2020 Microsoft Digital Defense Report https://www.microsoft.com/en-us/security/business/security-intelligence-report https://www.microsoft.com/en-us/security/business/security-i...
- slownews45 5y ago
  Offsite works fine, but for many people offsite is still accessible by current credentials. The S3 options around this work well with object lock or similar. I remember the old school tape methods (we had a rotation of who took the tape home). This was truly offline
Zababa 5y ago
> 2-3 year email retention on corp email. I work at a big company that does this, but with 6 months. While I understand why they would do that, often some knowledge is lost with these emails. And usually I don't know what's knowledge and what's junk before I need it. On the other hand, it's a good way to make sure that your processes are written somewhere and people don't rely too much on email archiving. Sadly, that's something I didn't realize until it was too late.
- ahtihn 5y ago
  I also work at a company with a shortish email retention time. The explicit goal is to force people to move important information to places where it's accessible for others.

orf 5y ago

You can also enable versioning and deny all s3:DeleteObject actions via the bucket policy. It won’t stop a root account compromise unless you’ve got a multi-account setup going (as they could edit the bucket policy). But if you’ve not got any monitoring, they could also just remove the lock on the objects without you noticing and wait for the timeout themselves.

TrueDuality 5y ago

A lot of sensitive data is legally required to be kept around for much longer than that (email is up to 15 years if you're a publicly traded company). Most of the remaining suggestions aren't relevant to ransomware even if they're otherwise mostly fine recommendations. 2FA won't stop ransomware, or data destruction. Redeploying code and reinstalling active directory doesn't restore customer or user databases. Paper files are not accessible when they're needed, are easily damaged or misplaced, and cost a lot to store and index (if you're referring to keeping them as backups then yes you're making a form of the argument of the post just in a very expensive and inconvenient way). Read-only S3 copies are almost certainly falling in the realm of backups... but is also a relatively expensive way to do it for most organizations larger than a start-up. Offline and offsite backups are the cheapest, most effective tool for keeping copies of your data in your companies possession due to unforeseen circumstances and they protect against a huge number of potential events beyond just ransomware. It's negligent IMO for executive officers of a company to not have invested in a solid, tested, and comprehensive backup solution.

allset_ 5y ago
Most attack campaigns start with compromised credentials, so MFA absolutely helps prevent ransomware.
- corty 5y ago
  Only about half. The rest is through emailed trojans and RCE bugs.
- TrueDuality 5y ago
  The two most common attack campaigns are drive-by malware infections done through phishing links and infections via compromised documents. Neither of which involve credentials. Attacks involving credential stealing almost never involve malware. Source: The 2020 Microsoft Digital Defense Report https://www.microsoft.com/en-us/security/business/security-intelligence-report https://www.microsoft.com/en-us/security/business/security-i...
slownews45 5y ago
Offsite works fine, but for many people offsite is still accessible by current credentials. The S3 options around this work well with object lock or similar. I remember the old school tape methods (we had a rotation of who took the tape home). This was truly offline

Zababa 5y ago

> 2-3 year email retention on corp email. I work at a big company that does this, but with 6 months. While I understand why they would do that, often some knowledge is lost with these emails. And usually I don't know what's knowledge and what's junk before I need it. On the other hand, it's a good way to make sure that your processes are written somewhere and people don't rely too much on email archiving. Sadly, that's something I didn't realize until it was too late.

ahtihn 5y ago
I also work at a company with a shortish email retention time. The explicit goal is to force people to move important information to places where it's accessible for others.