4 ms·

That's one of the ideas behind use of tape storage today interestingly. It's pretty hard (although not impossible) for hackers to get at tapes sitting on a she

That's one of the ideas behind use of tape storage today interestingly. It's pretty hard (although not impossible) for hackers to get at tapes sitting on a shelf.

999900000999 5y ago
If I write a text file to a USB drive without any iot features, and then throw the USB drive in my closet I'm not seeing how anyone could hack it . I guess you could drop an emp pulse on my house and fry the drive, but absent that it's safe.
- monocasa 5y ago
  Well, as a backup, USB drives don't have that great of a lifespan compared to tapes. They're also not nearly as space dense or competitive for $/GB once you've amortized the drives. And for an org, there's still attacks in both cases. Do your backups get requested through an automated system? Well you've just made a very slow tape library with people rather than robotics. Are the tapes/USB sticks encrypted and the encryption keys stored in an online system? Then the hackers have a mechanism to deny you access to the contents of the tapes, which is probably their goal anyway. Yes a USB drive with a text file is pretty safe from such attacks, but it also doesn't scale to the backup concerns of even relatively small orgs.
- deleted 5y ago
  [deleted]
- tempnow987 5y ago
  They key is usually something that is pretty current but can't be corrupted. A drive in a closet doesn't get you there. The nigeria office offline due to power does. I feel good with S3 with an object lock and retention policy for backups.
  - rectang 5y ago
    Pretty current, can't be corrupted, and complete. Unless you're practicing continuous restoration to ensure that your backups are actually backing up what you need, the odds that you got everything critical are not good.
    - tempnow987 5y ago
      The idea that throwing a USB in a drawer does better is absolutely ridiculous. I think this illustrates where folks can go wrong. Many folks and business TODAY are backing up to NAS / RAID arrays etc. Many are easily corruptible by ransomware. We see this REPEATEDLY with many infections of large orgs. The basic story here is that something not editable has great value even if not perfectly current. If you do a diff every 4 hours you have covered a LOT of ground already. I've sat through continuous DR architecturing discussions - the massive cost / complexity / scale can just be out of control for many users. In many use cases Active Directory for example behind by 4 hours is not game ending. With notice to users that recent edits may not be captured you may be able to get back up and running pretty quickly.
      - rectang 5y ago
        I'm not singing the praises of "a USB in a drawer" — the medium doesn't matter, the number of copies doesn't matter. The only criteria I am considering is whether the backups are tested to prove that they actually work as intended. There are shades of gray, here: continuous restoration is a best practice, but backups which are tested even once, and perhaps incompletely, are better than backups which are never tested at all.
        tempnow987 5y ago
        Many continuous restoration / HA systems are surprisingly vulnerable to hacks because the level of management / coordination is pretty high. They work well if datacenter 1 goes down and you want to get to datacenter 2. They work less well (in my view) if someone gets root. A fair number of public victims you read about actually DID have continuous backups / dr setups.
Damogran6 5y ago
It’s not the backup, it’s the -restoration-. TheBadGuy changes the encryption key used to make the backups, then waits %long enough%, you’re still boned.
- monocasa 5y ago
  There's no perfect scheme, but the best mechanisms I've seen for this in practice involve HSMs so that nobody, bad guy or good guy, can change the keys used for encryption without physically pulling the module, and it can be disconnected and stored at a safe location once the backup is complete. Each redundant set of a backup has an HSM, and the HSMs are cold stored in different physical locations. But yes, this is hard to get right as I hinted by the "but not impossible" quip.
  - hughrr 5y ago
    Many years ago I was working for a defence contractor and an idiot hit the TOTAL ERASE button on an HSM. This all went to hell when no one could work out how to load the keys into it again for nearly two weeks...
  - bradknowles 5y ago
    The storage of the backup medium should be in write-only mode. So, once written, they cannot be changed. That will help.
- Melatonic 5y ago
  Couldn't you just NOT encrypt your tape backups?
  - monocasa 5y ago
    Practically you don't want to do that. You want them to be useless to someone who steals a tape since it could be a long time to never before you realize it's gone. All the tapes on the shelf look alike.
    - 5y ago

That's one of the ideas behind use of tape storage today interestingly. It's pretty hard (although not impossible) for hackers to get at tapes sitting on a shelf.

999900000999 5y ago

If I write a text file to a USB drive without any iot features, and then throw the USB drive in my closet I'm not seeing how anyone could hack it . I guess you could drop an emp pulse on my house and fry the drive, but absent that it's safe.

monocasa 5y ago
Well, as a backup, USB drives don't have that great of a lifespan compared to tapes. They're also not nearly as space dense or competitive for $/GB once you've amortized the drives. And for an org, there's still attacks in both cases. Do your backups get requested through an automated system? Well you've just made a very slow tape library with people rather than robotics. Are the tapes/USB sticks encrypted and the encryption keys stored in an online system? Then the hackers have a mechanism to deny you access to the contents of the tapes, which is probably their goal anyway. Yes a USB drive with a text file is pretty safe from such attacks, but it also doesn't scale to the backup concerns of even relatively small orgs.
deleted 5y ago
[deleted]
tempnow987 5y ago
They key is usually something that is pretty current but can't be corrupted. A drive in a closet doesn't get you there. The nigeria office offline due to power does. I feel good with S3 with an object lock and retention policy for backups.
- rectang 5y ago
  Pretty current, can't be corrupted, and complete. Unless you're practicing continuous restoration to ensure that your backups are actually backing up what you need, the odds that you got everything critical are not good.
  - tempnow987 5y ago
    The idea that throwing a USB in a drawer does better is absolutely ridiculous. I think this illustrates where folks can go wrong. Many folks and business TODAY are backing up to NAS / RAID arrays etc. Many are easily corruptible by ransomware. We see this REPEATEDLY with many infections of large orgs. The basic story here is that something not editable has great value even if not perfectly current. If you do a diff every 4 hours you have covered a LOT of ground already. I've sat through continuous DR architecturing discussions - the massive cost / complexity / scale can just be out of control for many users. In many use cases Active Directory for example behind by 4 hours is not game ending. With notice to users that recent edits may not be captured you may be able to get back up and running pretty quickly.
    - rectang 5y ago
      I'm not singing the praises of "a USB in a drawer" — the medium doesn't matter, the number of copies doesn't matter. The only criteria I am considering is whether the backups are tested to prove that they actually work as intended. There are shades of gray, here: continuous restoration is a best practice, but backups which are tested even once, and perhaps incompletely, are better than backups which are never tested at all.
      - tempnow987 5y ago
        Many continuous restoration / HA systems are surprisingly vulnerable to hacks because the level of management / coordination is pretty high. They work well if datacenter 1 goes down and you want to get to datacenter 2. They work less well (in my view) if someone gets root. A fair number of public victims you read about actually DID have continuous backups / dr setups.

Damogran6 5y ago

It’s not the backup, it’s the -restoration-. TheBadGuy changes the encryption key used to make the backups, then waits %long enough%, you’re still boned.

monocasa 5y ago
There's no perfect scheme, but the best mechanisms I've seen for this in practice involve HSMs so that nobody, bad guy or good guy, can change the keys used for encryption without physically pulling the module, and it can be disconnected and stored at a safe location once the backup is complete. Each redundant set of a backup has an HSM, and the HSMs are cold stored in different physical locations. But yes, this is hard to get right as I hinted by the "but not impossible" quip.
- hughrr 5y ago
  Many years ago I was working for a defence contractor and an idiot hit the TOTAL ERASE button on an HSM. This all went to hell when no one could work out how to load the keys into it again for nearly two weeks...
- bradknowles 5y ago
  The storage of the backup medium should be in write-only mode. So, once written, they cannot be changed. That will help.
Melatonic 5y ago
Couldn't you just NOT encrypt your tape backups?
- monocasa 5y ago
  Practically you don't want to do that. You want them to be useless to someone who steals a tape since it could be a long time to never before you realize it's gone. All the tapes on the shelf look alike.
  - 5y ago