80% of orgs that paid the ransom were hit again • Hacker News Board

Re: 80% of orgs that paid the ransom were hit again

#321

Post by makeitdouble » Sat, Jun 19, 2021, 12:54 AM UTC

andrewmcwatters wrote: post #53

makeitdouble wrote: post #32

“Never negotiate with terrorists” is a simple and clear mantra, and as most clear and simple concepts it hides a lot of assumptions. One of them is you are ready to lose the hostage in the worst case scenario. That’s how the police sees it, because the society benefits more from being firm in individual cases than losing a few of its members that might not come back anyway. That’s a hard one to swallow, hard enough t…

From the perspective of the individual, there is no greater good than defending one’s self.

I tried to put it in a neutral way, and I think it’s a far from a black and white issue.

Not to go too sideways, but hostage (with humans, not data) situations are typically about other people. When you’re the target, it’s not your life on the line, but your loved/valuable ones. So you’re not defending just yourself, you actually have to care about at least someone else to have it happen to you. And some care about a lot more than just their loved ones, they’ll also think about their friends, family, sometimes the rest of the society.

Everyone is different and there is no absolute best, but let’s at least recognize it’s complex and there’s lots of ways to think about it.

Re: 80% of orgs that paid the ransom were hit again

#322

Post by failwhaleshark » Sat, Jun 19, 2021, 12:59 AM UTC

diego_moita wrote: post #175

What I suspect: the first ransom was paid by insurance, therefore it didn't hurt them, therefore they didn't bother protect themselves for the second. Now just wait to see what will happen to your insurance rate after you pay the third ransom. They certainly will begin to understand the need for backups.

Untested backups and DR/BCP procedures aren't backups.

Snapshots aren't backups.

Backups that aren't physically-isolated, typically offsite, aren't backups.

Re: 80% of orgs that paid the ransom were hit again

#323

Post by lurquer » Sat, Jun 19, 2021, 1:17 AM UTC

squiggleblaz wrote: post #253

lurquer wrote: post #243

Earlier quoted context omitted.

> where every single person in the entire company has to make 0 mistakes, and an attacker only has to get lucky once Good post. I don’t mean this criticism for you specifically. But, why is there an assumption among HN types that there are no bad-actors among the insiders? You can have all the safeguards you want, but if an insider deliberately installs something, you’re screwed. In some industries — armored trucks,…

I guess there's two questions: - is protecting against internal sabotage actually different that protecting against external attack. I don't think it's all that different. It comes down to authenticating actions and enforcing the principle of least privilege. If you built a system that was actually secure (i.e. one that depends on reasonable inconveniences, rather than one that depends on people to be perfect all the…

> Most people probably aren't inclined to deliberately target their own company. It's far more likely that there is a bad actor in the world who wants to target your company, than that there is in your company.

“Most” people are law abiding. So, I agree with the first sentence.

The second sentence, however, has little support. The universe of people who can do these types of attacks is large, but not universal. You need computer skills. Necessarily. Those with computer skills are usually already part of the industry. How many disgruntled people pass through the FAANGs each year? Now add in all the IT positions at the banks.

In short, there are probably tens of thousands of domestic ‘bad actors’ who have (or will have in their careers) access.

Probably more.

Re: 80% of orgs that paid the ransom were hit again

#324

Post by phaedrus » Sat, Jun 19, 2021, 1:31 AM UTC

sdoering wrote: post #302

hellbannedguy wrote: post #258

Earlier quoted context omitted.

And let's not discount the moral of low paid, overworked employees, and companies that let low level managers run roughshod over lower level employees. My point is don't discount inside corporate espionage by disgruntled any level employees. Thank goodness I didn't have access to a script that would lock up at least two of my past employers when coming up years ago? Then again, I personally haven't been that mad, but…

I used to care for the security of my work machine. I was sole admin. No corporate crap- or spyware. I was responsible and I learned a lot. We got bought. Big corp enforced Endpoint Management and a whole barrage of corporate spyware. I am not an admin anymore. I can't even use an AdBlock solution anymore. And guess what. I don't give a damn anymore. If the device enforces an update, so he it. If I have to double app…

I have a direct A/B experiment on this: I have one work laptop which is centrally managed by big-corp IT (I'm not the admin), and one laptop which is a project machine which I manage and admin.

Guess what? The big-corp IT managed computer which I only use to check email and edit Word docs is almost unusably slow, weighed down as it is with antivirus, surveillance software, centralized updates, etc. The project machine which I manage and have admin access to remains snappy despite its workload (Visual Studio) and older hardware.

Also, you gotta love the "cost savings" of let's outsource our IT, not let developers be admins on their own machine: now we have to buy secondary machines that developers ARE admin of, so they can get their work done.

Re: 80% of orgs that paid the ransom were hit again

#325

Post by weare138 » Sat, Jun 19, 2021, 1:36 AM UTC

mywittyname wrote: post #244

rossdavidh wrote: post #210

Earlier quoted context omitted.

...and if you pay for our Premium Level Service, we'll secure your systems against other criminal enterprises as well!

What Hackers Can Learn From The Sopranos.

That's a nice network you have there. It would be ashamed if something happened to it if you know what I mean.

Re: 80% of orgs that paid the ransom were hit again

#326

Post by smitty1e » Sat, Jun 19, 2021, 1:43 AM UTC

"And that is called paying the Dane-geld;

But we've proved it again and again,

That if once you have paid him the Dane-geld

You never get rid of the Dane."

https://www.poetryloverspage.com/poets/kipling/dane_geld.htm...

Re: 80% of orgs that paid the ransom were hit again

#327

Post by spc476 » Sat, Jun 19, 2021, 1:52 AM UTC

squiggleblaz wrote: post #253

lurquer wrote: post #243

Earlier quoted context omitted.

> where every single person in the entire company has to make 0 mistakes, and an attacker only has to get lucky once Good post. I don’t mean this criticism for you specifically. But, why is there an assumption among HN types that there are no bad-actors among the insiders? You can have all the safeguards you want, but if an insider deliberately installs something, you’re screwed. In some industries — armored trucks,…

I guess there's two questions: - is protecting against internal sabotage actually different that protecting against external attack. I don't think it's all that different. It comes down to authenticating actions and enforcing the principle of least privilege. If you built a system that was actually secure (i.e. one that depends on reasonable inconveniences, rather than one that depends on people to be perfect all the…

Here's a bit of detail about an internal attack I was involved with: http://boston.conman.org/2004/09/19.1 It wasn't a disgruntled employee---it was an employee who was hired by another party to get hired by the target, spend six months there, and did his thing on a particular date.

Re: 80% of orgs that paid the ransom were hit again

#328

Post by wrycoder » Sat, Jun 19, 2021, 2:16 AM UTC

WalterBright wrote: post #213

wrycoder wrote: post #138

Earlier quoted context omitted.

Many people’s backup routines aren’t good enough. Some of these guys encrypt over a period of time which is long enough to exceed the backup rotation. Their code decrypts on request, until the trigger day, when it posts the banners and deletes itself.

That's why you have a combination of rotating backups, say 7, one a day, and non-rotating permanent backups, say once a week. Also, one should use "append only" backups (such as tape), or a disk drive designed to be append only with hardware write enables.

With a de-duplicating backup system like Borg, you can keep more backups in the same space. borgbase.com provides append-only and 2FA, which keeps your backups secure.

Re: 80% of orgs that paid the ransom were hit again

#329

Post by bluGill » Sat, Jun 19, 2021, 2:25 AM UTC

sandworm101 wrote: post #251

ryanmcbride wrote: post #203

Earlier quoted context omitted.

I'd like to think security training can take care of it, that people can be careful and considerate and have a skeptical eye about every single message they receive. But it only takes one person and these huge companies employ so many people. So many times, even at companies with really strict security training I've seen people just walk away from their unlocked computers, click random links in emails, stuff like tha…

>> But it only takes one person and these huge companies employ so many people. No. It never takes only one employ clicking a bad link. It takes that click, plus a browser/email/os system that allow for random code to executed. It take an IT department that has allowed individual non-IT employees to use computers with elevated privileges. It requires a management structure that has failed to invest in proper off-site…

Notice the previous comment about developers not allowed to be admin of their own machines? On computers with a good security model developers don't need to be admin of their own machines, but that wasn't thought of.

Re: 80% of orgs that paid the ransom were hit again

#330

Post by bluGill » Sat, Jun 19, 2021, 2:26 AM UTC

phaedrus wrote: post #324

sdoering wrote: post #302

Earlier quoted context omitted.

I used to care for the security of my work machine. I was sole admin. No corporate crap- or spyware. I was responsible and I learned a lot. We got bought. Big corp enforced Endpoint Management and a whole barrage of corporate spyware. I am not an admin anymore. I can't even use an AdBlock solution anymore. And guess what. I don't give a damn anymore. If the device enforces an update, so he it. If I have to double app…

I have a direct A/B experiment on this: I have one work laptop which is centrally managed by big-corp IT (I'm not the admin), and one laptop which is a project machine which I manage and admin. Guess what? The big-corp IT managed computer which I only use to check email and edit Word docs is almost unusably slow, weighed down as it is with antivirus, surveillance software, centralized updates, etc. The project machin…

If a developer needs to be admin to do their work the os needs a better security model.