80% of orgs that paid the ransom were hit again • Hacker News Board

Re: 80% of orgs that paid the ransom were hit again

#381

Post by bluGill » Sun, Jun 20, 2021, 11:35 AM UTC

0x0203 wrote: post #339

bluGill wrote: post #330

Earlier quoted context omitted.

If a developer needs to be admin to do their work the os needs a better security model.

That's highly dependent on the type of development work. I'm a kernel developer and I need regular access to privileged components of the system for a wide variety of reasons. It could be argued that all standard *nix/windows/mac systems need a better security model to better isolate specific tasks, but for much of what I need to do (e.g., create, modify file systems/boot loaders/kernels, ptrace processes, etc...), i…

You shouldn't be doing your kernel development testing on the same machine as you do your office tasks.

Though I will agree there are exceptions, you are not one

Re: 80% of orgs that paid the ransom were hit again

#382

Post by arendtio » Sun, Jun 20, 2021, 6:54 PM UTC

failwhaleshark wrote: post #322

diego_moita wrote: post #175

What I suspect: the first ransom was paid by insurance, therefore it didn't hurt them, therefore they didn't bother protect themselves for the second. Now just wait to see what will happen to your insurance rate after you pay the third ransom. They certainly will begin to understand the need for backups.

Untested backups and DR/BCP procedures aren't backups. Snapshots aren't backups. Backups that aren't physically-isolated, typically offsite, aren't backups.

Please define snapshot.

I suspect you mean filesystem snapshots and as long as the snapshot lives on the same physical media you are correct. But when you take the snapshot and transfer it to a physically separate location where it cannot be altered it sounds like a backup to me.

Re: 80% of orgs that paid the ransom were hit again

#383

Post by failwhaleshark » Mon, Jun 21, 2021, 3:51 AM UTC

arendtio wrote: post #382

failwhaleshark wrote: post #322

Earlier quoted context omitted.

Untested backups and DR/BCP procedures aren't backups. Snapshots aren't backups. Backups that aren't physically-isolated, typically offsite, aren't backups.

Please define snapshot. I suspect you mean filesystem snapshots and as long as the snapshot lives on the same physical media you are correct. But when you take the snapshot and transfer it to a physically separate location where it cannot be altered it sounds like a backup to me.

Physically-separate location or not snapshots that can be added, updated, culled, or deleted by local systems aren't backups, they're replication. Replication replicates problems.

Vaulted offsite on at-rest storage media is the only valid way to store backups. Every other "convenient" "backup" service or snapshot replication process is a liability businesses must avoid. Lose all your data, 50%+ you're out of business, and The End.

Re: 80% of orgs that paid the ransom were hit again

#384

Post by failwhaleshark » Mon, Jun 21, 2021, 4:14 AM UTC

VendorManager wrote: post #380

des1nderlase wrote: post #349

Earlier quoted context omitted.

Backups are there to provide a business continuity in wide range of disruptions. What you want to protect your business from is up to you, but typically you need protection from all things OP mentioned.

Backups and disaster recovery sites are definitely important from business continuity perspective, but there is a bigger risk of leaking PII and other sensitive information such as SIN / Social security numbers if the software vendor has access to it. Your business might be able to recover from backup if the hacker has not encrypted it, but the hacker for sure will be maliciously using the PII information to send phi…

These are somewhat orthogonal issues.

1. Test and encrypt backups.

2. Don't get hacked. Defense-in-depth philosophy and rigorous, routine social-engineering training/testing. If you get hacked, it's usually game over. Defend systems like the business depends on it because it does.

3. Limit exfil: extra security for PII, exfil detection, and [HN]I[DP]S.

Re: 80% of orgs that paid the ransom were hit again

#385

Post by tomrod » Mon, Jun 21, 2021, 1:02 PM UTC

WalterBright wrote: post #371

tomrod wrote: post #362

Earlier quoted context omitted.

What type of market is it when there is no regulation to protect rights, whether property, natural, or civil?

Anarchy is one. Communism is the other, as you have no property rights.

These are political systems, not economic systems.

When I hear people describe a free market, the respect for property rights is sacrosanct yet many also push back on regulation. This confuses me. Regulation typically seeks to ensure rights are respected.

Re: 80% of orgs that paid the ransom were hit again

#386

Post by sdoering » Tue, Jun 22, 2021, 4:12 PM UTC

phaedrus wrote: post #324

sdoering wrote: post #302

Earlier quoted context omitted.

I used to care for the security of my work machine. I was sole admin. No corporate crap- or spyware. I was responsible and I learned a lot. We got bought. Big corp enforced Endpoint Management and a whole barrage of corporate spyware. I am not an admin anymore. I can't even use an AdBlock solution anymore. And guess what. I don't give a damn anymore. If the device enforces an update, so he it. If I have to double app…

I have a direct A/B experiment on this: I have one work laptop which is centrally managed by big-corp IT (I'm not the admin), and one laptop which is a project machine which I manage and admin. Guess what? The big-corp IT managed computer which I only use to check email and edit Word docs is almost unusably slow, weighed down as it is with antivirus, surveillance software, centralized updates, etc. The project machin…

Fun note at that. If nothing happens the CIO states boastfully how their spyware prevented crap from happening. If shit happens it is elaborate stuff we need more protection against.