3 ms·
> you just rebuild the affected VMs from scratch These people have administrative access, and at least in some cases network and physical access. Once you de
by bigiain 2y ago
> you just rebuild the affected VMs from scratch
These people have administrative access, and at least in some cases network and physical access.
Once you determine they are untrustworthy and potentially malicious, you can't just rebuild the VMs, since you can no longer trust the hypervisor or even the hardware.
If they were Chinese or Mossad agents, you'd start from scratch in a different DC on supply chain audited new compute, storage, and networking hardware. And you'd compile everything from audited source. And I have NFI how you'd deal with potential malicious changes to your data and backups.
- leptons 2y ago> And I have NFI how you'd deal with potential malicious changes to your data and backups. The backups should be stored on WORM tape. They can't be altered (easily or at all?). Of course they're probably wiping their asses with the backups like they are the constitution.
- modderation 2y agoWORM prevents after-the-fact modification, but it isn't very helpful in the case of persistent threats. The concern is that the tampering has already been committed to the backups. When was the "Break Glass" password last rotated? Is it protected by one or more Yubikeys that were manufactured before they fixed that nasty exploit? What other attack vectors are baked in through malfeasance or human error?
- leptons 2y agoMy comment was not in reply to passwords, "yubikeys" or anything else you mentioned, so your techsplaining about those things was a bit misplaced. MY point was that if the backups are on WORM tapes, and we still have those backups, then there's nothing to fear being compromised from those backups. Everything other than WORM tapes you wrote about is outside the scope of my comment.