91–100 of 139 posts
My prediction: Ransomware will be the scapegoat that leads the way on making the use of encryption a criminal offence. This is exactly what many governments want. Up till now, the best argument against encryption is "we can't see what criminals are doing", but that isn't very tangible for many people. Just wait until a powergrid or water treatment plant in the US is down for weeks due to being "attacked with encrypti…
I doubt it, my guess is it will (understandably) be used as the scapegoat to kill cryptocurrency and/or put it under a central authority controlled by governments. Ransomware was basically non-existent before criminals had a way of being paid anonymously.
Earlier quoted context omitted.
It also ignores the perverse game being played. Defense has to work every time. Attackers just have to get through once. That's a game that favors the attackers.
It's a wonder our own immune systems work as well as they do...
Also, the thing is, our immune system isn't exempt from false-positives. I'm not sure we want a society with as many false-positives.
> Not surprisingly, dozens of major ransomware gangs now exist worldwide, including in Russia, Eastern Europe, and North Korea. To what extent should ransomware activity be considered low-grade economic warfare by nation-states who can't or won't police cyber-criminals, and thus justification for robust national responses such as sanctions?
This reminds me of privateering during the age of sail.
1. https://www.usni.org/magazines/proceedings/2019/october/gran...
Ransomware provides a useful service and should be legal. Businesses with poor security practices deserve to be punished for their negligence.
> Gangs also have begun encrypting backup systems, including cloud storage services such as Office 365 and Drop-box. Although 56% of the firms surveyed by Sophos regained control of their data through backups, that window appears to be closing. "[Cybergangs] have realized that the ransom demand becomes powerless if you have a full backup set in place and you can revert to it," This is why our backups at work write to…
Similar, rsync.net has historical ZFS snapshots that only cost the diff of the files.
Earlier quoted context omitted.
Kidnapping provides a useful service and should be legal. Schools, kindergardens and parents with poor security practices deserve to be punished for their negligence.
Schools, kindergartens and parents have a legal responsibility for children under their protection. However it has been repeatedly proven that businesses who allow enormous amounts of user's personal and financial data to be leaked will suffer no meaningful consequences. See: Yahoo!, Target, Experian, etc.
Also:
Ransomware gangs also target companies that do not have "enormous amounts of user's personal and financial data".
Since too many companies didn't pay ransomware gangs now have taken to stealing data in addition - are you fine with a ransomware gang selling your personal data then, because they are "helping"?
Earlier quoted context omitted.
Kidnapping provides a useful service and should be legal. Schools, kindergardens and parents with poor security practices deserve to be punished for their negligence.
It also ignores the perverse game being played. Defense has to work every time. Attackers just have to get through once. That's a game that favors the attackers.
Earlier quoted context omitted.
I'm wondering if they also have Scrum Masters and other consultants.
Get those crime tasks into Jira!
Earlier quoted context omitted.
>The OS, files and configuration which can be unchangeable are trivially replaceable and thus does not really need to be protected. Precisely the wrong way to think about this. If the OS can't protect itself, you've got a system with zero security.
Well, that's true, OS being able to protect itself is useful and necessary, but my point is that it's nowhere near sufficient (as your parent post seems to imply) for preventing consequences of ransomware attacks, because by the time standard OS protections (which are reasonable) are broken because attackers have privileged access, they can also do worse things than just attack the single computers' OS, and if they c…
First - protect the AD and authentication infrastructure from a black start event.
I'd have an offline physical machine, no matter how old, that was a viable backup domain controller. I would have a stack of hard drives for it, and a copy of clonezilla. Every so often, clone the hard drive, boot the replacement, and sync it with the domain, then turn it off.
For the truly paranoid, do this in each location. Keep the machine and drives in a safe.
Test the black start backups on a temporary network built from spare hardware. Note that if you boot a Windows machine, it might adapt itself to the hardware and cause issues, so discard that image, and regenerate it.
In a black start event, you could turn off all the outside networks, and start with the old AD server, and restore from backups.
--
Any Virtualization or SAN layers should have administrative credentials that are unused for anything else, and only written down on pieces of paper, never scanned or typed in.
All servers should have saved images in offline, unencrypted hard drives, in a safe.
--
The main thing then is to get periodic offline unencrypted backups of the systems and data in a safe.
--
So, if the system is breached, there is at least a way to restore to the last backup, and you have some confidence it actually works.