4 ms·
That only solves half the problem, it doesn't solve data theft
by mango7283 2y ago
That only solves half the problem, it doesn't solve data theft
- musicale 2y ago1. Is data theft the main risk of ransomware? 2. Why would anyone trust a ransomware perpetrator to honor a deal to not reveal or exploit data upon receipt of a single ransom payment? Are organizations really going to let themselves be blackmailed for an indefinite period of time? 3. I'm unconvinced that crowdstrike will reliably prevent sensitive data exfiltration.
- mango7283 2y ago1. Double extortion is the norm, some groups don't even bother with the encryption part anymore, they just ask a ransom for not leaking the data 2. Appearently yes. Why do you think calls to ban payments exist? 3. At minimum it raises the bar for the hackers - sure, it's not like you can't bypass edr but it's much easier if you don't have to bypass it at all because it's not there
- jjav 2y ago> That only solves half the problem, it doesn't solve data theft crowsdstrike is not a DLP solution. You can solve that problem (where necessary) by less intrusive means.
- mango7283 2y agoI agree edr is not a DLP solution, but edr is there to prevent* an attack getting to the point where staging the data exfil happens... In which case yes I would expect web/volumetric DLP kicks in as the next layer. *Ok ok I know it's bypassable but one of the happy paths for an attack is to pivot to the machine that doesn't have edr and continue from there.