4 ms·

The article glosses over one thing: you should have at least one backup that is not accessible through the company network. A different site connected to the sa

The article glosses over one thing: you should have at least one backup that is not accessible through the company network. A different site connected to the same network is accessible by ransomware gangs once they are in.

dredmorbius 5y ago
This is pretty much precisely how Maersk recovered from the NotPetya worm attack, though the circumstances were serendiptous rather than planned: ... After a frantic search that entailed calling hundreds of IT admins in data centers around the world, Maersk’s desperate administrators finally found one lone surviving domain controller in a remote office—in Ghana. At some point before NotPetya struck, a blackout had knocked the Ghanaian machine offline, and the computer remained disconnected from the network. It thus contained the singular known copy of the company’s domain controller data left untouched by the malware—all thanks to a power outage. “There were a lot of joyous whoops in the office when we found it,” a Maersk administrator says. When the tense engineers in Maidenhead set up a connection to the Ghana office, however, they found its bandwidth was so thin that it would take days to transmit the several-hundred-gigabyte domain controller backup to the UK. Their next idea: put a Ghanaian staffer on the next plane to London. But none of the West African office’s employees had a British visa. So the Maidenhead operation arranged for a kind of relay race: One staffer from the Ghana office flew to Nigeria to meet another Maersk employee in the airport to hand off the very precious hard drive. That staffer then boarded the six-and-a-half-hour flight to Heathrow, carrying the keystone of Maersk’s entire recovery process. ... https://tech.industry-best-practice.com/2018/10/14/the-untold-story-of-notpetya-the-most-devastating-cyberattack-in-history/ https://tech.industry-best-practice.com/2018/10/14/the-untol...

dredmorbius 5y ago

This is pretty much precisely how Maersk recovered from the NotPetya worm attack, though the circumstances were serendiptous rather than planned: ... After a frantic search that entailed calling hundreds of IT admins in data centers around the world, Maersk’s desperate administrators finally found one lone surviving domain controller in a remote office—in Ghana. At some point before NotPetya struck, a blackout had knocked the Ghanaian machine offline, and the computer remained disconnected from the network. It thus contained the singular known copy of the company’s domain controller data left untouched by the malware—all thanks to a power outage. “There were a lot of joyous whoops in the office when we found it,” a Maersk administrator says. When the tense engineers in Maidenhead set up a connection to the Ghana office, however, they found its bandwidth was so thin that it would take days to transmit the several-hundred-gigabyte domain controller backup to the UK. Their next idea: put a Ghanaian staffer on the next plane to London. But none of the West African office’s employees had a British visa. So the Maidenhead operation arranged for a kind of relay race: One staffer from the Ghana office flew to Nigeria to meet another Maersk employee in the airport to hand off the very precious hard drive. That staffer then boarded the six-and-a-half-hour flight to Heathrow, carrying the keystone of Maersk’s entire recovery process. ... https://tech.industry-best-practice.com/2018/10/14/the-untold-story-of-notpetya-the-most-devastating-cyberattack-in-history/ https://tech.industry-best-practice.com/2018/10/14/the-untol...