3 ms·
Having point in time backups is a good start but I can see ransom-ware adopt to slowly corrupt your data in a way that is reversible but may take months to dete
by czl 5y ago
Having point in time backups is a good start but I can see ransom-ware adopt to slowly corrupt your data in a way that is reversible but may take months to detect. Your backups going back months will then have this corruption. To detect this application level tripwires may be needed like checksums etc. Finally there is always reputation damage and threats to expose the attack an your data to the public via blackmail. Just because you have backups does not make you safe.
- gjs278 5y ago
- EvanAnderson 5y agoApplication "tripwires" are just another obstacle for an attacker to overcome. If audits aren't external to the system being audited they're just as vulnerable to manipulation. A Customer of mine in the financial sector sent their backups to a third-party for independent verification quarterly. The third-party restored data into a clean system reconciled against the production system. That would be the kind of auditing that would be more apt to detect the "low and slow" attack.