4 ms·

I’m always amazed that these attacks work. Don’t they have off site backups, cloud backups etc. I get it being a disruption, and loss of privacy for citizens.

I’m always amazed that these attacks work. Don’t they have off site backups, cloud backups etc. I get it being a disruption, and loss of privacy for citizens. However why are they stopping appointments.

TedDoesntTalk 5y ago
What if the ransomware infiltrated 3 months ago but was not activated until now? Restoring a 3-month old backup is not useful if the data changes significantly each day.
- hulitu 5y ago
  I don't think the bad guys wait 3 months. Time is money. They have no advantage in waiting.
  - scohesc 5y ago
    On the contrary - If you have an incremental backup that goes as far back as say 14 days for example. No separate archived snapshots, etc. If you infiltrate the network and figure out this crucial bit of info - you just wait 14 days while you branch out and infect more PCs, more of the network. Once 14 days goes by, it's guaranteed that any data the victim tries to restore from is corrupted or potentially encrypted with ransomware.
  - PeterisP 5y ago
    I believe that forensics of major attacks does show that usually the bad guys have been in the network for weeks before triggering the ransomware, and it rarely happens on the same day as the initial attack. The expectation is that they will first spend the time and effort to look at your network to find out your backup process, and do/wait as much as is necessary to circumvent, disable or destroy your backups if it can be easily done.
dreamcompiler 5y ago
It's largely bad security practice. They always say "We have backups." But in reality, --The backups are not only not offsite; they are online and attackable. --Backups are not done every day on every machine. The machines on which backups are done most rigorously are the gift shop cash registers and the machine that runs the janitorial scheduling spreadsheet. The blood test results pub/sub system was last backed up in 2019. --The restore procedure is never tested. Not rarely, never. Because it would take machines out of service for an hour. Can't have that. --Joe who runs department X drags his feet about upgrading his organization's computers and getting on the corporate backup rotation. And if department X gets taken out, the whole company shuts down. --Bob in the basement is running a research network nobody knows about, and he puts it directly on the Internet so he can run his experiments from home. And of course it contains a bridge to the corporate intranet. It's just a clusterfuck everywhere. Good people busy getting their jobs done who see security procedures as obstacles to work around. The bad guys completely understand this organizational dynamic and they exploit it for profit.
- technion 5y ago
  Just adding to these from my favourite incident: You restore from backups to alternate hardware, but your key software is license locked to hardware. It was always the documented recovery process to contact the vendor and request a new license. Their SLA is 30 days.
landemva 5y ago
Some IT types still think RAID 5 is a backup and recovery solution because they think a failed drive hot-swap fixes everything. The recurring failures are actually due to weak management.

TedDoesntTalk 5y ago

What if the ransomware infiltrated 3 months ago but was not activated until now? Restoring a 3-month old backup is not useful if the data changes significantly each day.

hulitu 5y ago
I don't think the bad guys wait 3 months. Time is money. They have no advantage in waiting.
- scohesc 5y ago
  On the contrary - If you have an incremental backup that goes as far back as say 14 days for example. No separate archived snapshots, etc. If you infiltrate the network and figure out this crucial bit of info - you just wait 14 days while you branch out and infect more PCs, more of the network. Once 14 days goes by, it's guaranteed that any data the victim tries to restore from is corrupted or potentially encrypted with ransomware.
- PeterisP 5y ago
  I believe that forensics of major attacks does show that usually the bad guys have been in the network for weeks before triggering the ransomware, and it rarely happens on the same day as the initial attack. The expectation is that they will first spend the time and effort to look at your network to find out your backup process, and do/wait as much as is necessary to circumvent, disable or destroy your backups if it can be easily done.

dreamcompiler 5y ago

It's largely bad security practice. They always say "We have backups." But in reality, --The backups are not only not offsite; they are online and attackable. --Backups are not done every day on every machine. The machines on which backups are done most rigorously are the gift shop cash registers and the machine that runs the janitorial scheduling spreadsheet. The blood test results pub/sub system was last backed up in 2019. --The restore procedure is never tested. Not rarely, never. Because it would take machines out of service for an hour. Can't have that. --Joe who runs department X drags his feet about upgrading his organization's computers and getting on the corporate backup rotation. And if department X gets taken out, the whole company shuts down. --Bob in the basement is running a research network nobody knows about, and he puts it directly on the Internet so he can run his experiments from home. And of course it contains a bridge to the corporate intranet. It's just a clusterfuck everywhere. Good people busy getting their jobs done who see security procedures as obstacles to work around. The bad guys completely understand this organizational dynamic and they exploit it for profit.

technion 5y ago
Just adding to these from my favourite incident: You restore from backups to alternate hardware, but your key software is license locked to hardware. It was always the documented recovery process to contact the vendor and request a new license. Their SLA is 30 days.

landemva 5y ago

Some IT types still think RAID 5 is a backup and recovery solution because they think a failed drive hot-swap fixes everything. The recurring failures are actually due to weak management.