5 ms·

Because backups are exceedingly tedious and cost tons of money. Many people and organizations decide it's cheaper to not spend money against a potential threat

Because backups are exceedingly tedious and cost tons of money. Many people and organizations decide it's cheaper to not spend money against a potential threat or risk, and to their credit it is in fact cheaper. That is, of course, until the threat or risk becomes real rather than potential. Suddenly you have Lady Luck staring you down at your front door, invoice in hand demanding immediate payment of principal and all interest accrued. Incidentally, this is why (at least at the consumer level) cloud storage and backups have become so prominent and in many cases forcefed by hardware, software, and service providers: Because it's hands-free and cheap data security for most consumers. Unfortunately, this doesn't always scale to large enterprise organizations.

jorvi 2y ago
Back-ups are also not going to save you if the infection is time-delayed.
- hi-v-rocknroll 2y ago
  Then you confused backups for replication and don't understand how business continuity planning / disaster recovery work.
  - martyvis 2y ago
    You might have a good backup from say a week ago which is great to recover from but then you still have to sift out what may have been compromised transaction-wise if the attackers were clever in hiding their attack
    - hi-v-rocknroll 2y ago
      That's not how reimaging compromised systems and restoring only data works.
  - waste_monk 2y ago
    I think they mean the scenario where the attacker sneaks in and adds a persistent backdoor / sets up privileged accounts for themselves to use / generally makes themselves comfortable, and then sits on their thumbs for a long period of time before activating the ransomware. If the victim restores from the previous day / week / months backup, the attacker can then sneak right back in and re-exploit whatever vulnerability. The proposition then becomes "Our last non-compromised (as far as we know) backup is half a year old, can we afford to lose months of progress, or should we just pay the ransom?". Or perhaps the attacker doesn't have a persistent foothold, but can make a credible claim that they do - do you take the risk? Keeping in mind that every moment you burn investigating and trying to discover the extent of the compromise is another moment you're down and burning money.
    - hi-v-rocknroll 2y ago
      You're conflating offsite data backups with some sort of system backups. Then you have to start over with fresh, sterile, secured systems and good data by having multiple, regular data backups. Don't bother trying undo compromised systems because you'll never win that game.
      - prng2021 2y ago
        I'm not following. Are you implying that malware can't infect data and remain undetected?
muzani 2y ago
Governments can fund counter-terrorist teams to take out terrorists and bank robbers, and have a whole complicated infrastructure of water to deal with fires, but paying someone to copy files into a briefcase every day is too expensive.

jorvi 2y ago

Back-ups are also not going to save you if the infection is time-delayed.

hi-v-rocknroll 2y ago
Then you confused backups for replication and don't understand how business continuity planning / disaster recovery work.
- martyvis 2y ago
  You might have a good backup from say a week ago which is great to recover from but then you still have to sift out what may have been compromised transaction-wise if the attackers were clever in hiding their attack
  - hi-v-rocknroll 2y ago
    That's not how reimaging compromised systems and restoring only data works.
- waste_monk 2y ago
  I think they mean the scenario where the attacker sneaks in and adds a persistent backdoor / sets up privileged accounts for themselves to use / generally makes themselves comfortable, and then sits on their thumbs for a long period of time before activating the ransomware. If the victim restores from the previous day / week / months backup, the attacker can then sneak right back in and re-exploit whatever vulnerability. The proposition then becomes "Our last non-compromised (as far as we know) backup is half a year old, can we afford to lose months of progress, or should we just pay the ransom?". Or perhaps the attacker doesn't have a persistent foothold, but can make a credible claim that they do - do you take the risk? Keeping in mind that every moment you burn investigating and trying to discover the extent of the compromise is another moment you're down and burning money.
  - hi-v-rocknroll 2y ago
    You're conflating offsite data backups with some sort of system backups. Then you have to start over with fresh, sterile, secured systems and good data by having multiple, regular data backups. Don't bother trying undo compromised systems because you'll never win that game.
    - prng2021 2y ago
      I'm not following. Are you implying that malware can't infect data and remain undetected?

muzani 2y ago

Governments can fund counter-terrorist teams to take out terrorists and bank robbers, and have a whole complicated infrastructure of water to deal with fires, but paying someone to copy files into a briefcase every day is too expensive.