4 ms·
For automated ransomewhere this works. For targeted - it often doesn't because often your AWS keys are on the system doing the back up and have permissions to
by slownews45 5y ago
For automated ransomewhere this works.
For targeted - it often doesn't because often your AWS keys are on the system doing the back up and have permissions to delete items etc.
Of course, this is why S3 allows you to set and object lock rule (ie, 30 days is plenty) that means even you (or your computer) can't go and delete those online backups.
- gregsadetsky 5y agoThat's great to hear about the object lock rule, thanks a lot. I'll add that to my S3 setups.
- titaniczero 5y agoAlso, if this were for a company I'd suggest to test the backup at least once during the object lock duration: e.g. if the object lock is set to 30 days, you have to test them at least once (e.g.: day 15). That's because a targeted attack with a ransomware could gain access to your servers and wait 30 days while silently encrypting your backups until the 30th day, when the attackers could just complete the attack encrypting the rest of the files and showing the message. So my recommendation for extremely critical data would be: 1) Test whole data thoroughly at least once during the object lock period. 2) Setup an automatic task that retrieves X random data every day (or the longest period of time you can afford to lose it) and perform checks with checksums or other methods. If something is corrupt and/or encrypted you will realize before it is too late.
- gregsadetsky 5y agoThanks a lot! I appreciate the insight
- rsync 5y ago"For targeted - it often doesn't because often your AWS keys are on the system doing the back up and have permissions to delete items etc." Just a reminder - snapshots at rsync.net are immutable.[1] Even if Mallory gains access to all of your access credentials, she cannot delete/change the snapshots in your rsync.net account. [1] https://twitter.com/rsyncnet/status/1453044746213990405 https://twitter.com/rsyncnet/status/1453044746213990405
- pnutjam 5y agoI have send internal drive that gets an rsync of my first drive. First drive is xfs currently, second drive is btrfs. After the rsync, the drive gets a snapshot, then it's unmounted. For cloud, I use a time4vps storage server. I rsync some data and use borg for more sensitive stuff.