The ransomware surge • Hacker News Board

Re: The ransomware surge

#211

Post by danuker » Sat, May 08, 2021, 4:04 PM UTC

dghlsakjg wrote: post #68

danuker wrote: post #16

Earlier quoted context omitted.

4. It snuffs those pesky troublemakers and brings them back in line through monetary inflation across generations.

Bitcoin has been around for less than twenty years. Since then it has seen massive deflationary periods (when the relative value rises, like up until a month ago), and massive inflationary periods (when the value drops) In 2018 bitcoin had an "inflation" rate of roughly 500% (meaning that at the beginning of 2018 you could buy a basket of goods with an equivalent value of $13.5k USD, at the end of the year you had to…

There is volatility for sure. But the same is true for any asset: stocks, bonds, real estate, even gold. Albeit not as much as a currency only around for 20 years, as you said.

As for loans, lots of exchanges let you trade with leverage, effectively trading on borrowed money.

Also, there exist institutionally backed Bitcoin options: https://www.cmegroup.com/trading/equity-index/us-index/bitco...

Re: The ransomware surge

#212

Post by beermonster » Sat, May 08, 2021, 8:23 PM UTC

korethr wrote: post #80

Backups. I cannot emphasize enough the importance of backups. Take backups, verify your ability to restore from them, and keep them segregated from the rest of your infrastructure. It doesn't matter how inelegant and hacky your backup solution is, so long as you can restore from it. Any backup you can restore from is better than no backup. You might get a call from one of your application engineers shortly before bed…

Backups help recover your data. But gangs have evolved. They also use exfiltration of your data to embarrass you into paying up, which backups do not mitigate against: the public shaming.

Re: The ransomware surge

#213

Post by beermonster » Sat, May 08, 2021, 8:27 PM UTC

kemonocode wrote: post #104

korethr wrote: post #80

Backups. I cannot emphasize enough the importance of backups. Take backups, verify your ability to restore from them, and keep them segregated from the rest of your infrastructure. It doesn't matter how inelegant and hacky your backup solution is, so long as you can restore from it. Any backup you can restore from is better than no backup. You might get a call from one of your application engineers shortly before bed…

Modern ransomware gangs focus more on data exfiltration rather than actually locking down data, and it lets them remain undetected for longer too. That said, yes, correct, having good and reliable backups is vital.

In combination with techniques to minimise easy/unrestricted exfiltration of data. Such as egress filtering, software access policies/controls, minimum privilege, network segregation/isolation, good user access and network access controls, decent patching policy, good and tested backups and incident response plan…yada yada. Make sure if they do get in, the damage is limited.

Re: The ransomware surge

#214

Post by beermonster » Sat, May 08, 2021, 8:28 PM UTC

tomrod wrote: post #97

korethr wrote: post #80

Backups. I cannot emphasize enough the importance of backups. Take backups, verify your ability to restore from them, and keep them segregated from the rest of your infrastructure. It doesn't matter how inelegant and hacky your backup solution is, so long as you can restore from it. Any backup you can restore from is better than no backup. You might get a call from one of your application engineers shortly before bed…

You know, I'm curious how large cloud providers handle this. Obviously EC2 for AWS, but what about managed services? A bad ransomware attack on a large cloud provider could cripple a significant portion of the internet.

VPCs are segregated.

Re: The ransomware surge

#215

Post by beermonster » Sat, May 08, 2021, 8:29 PM UTC

thorwasdfasdf wrote: post #93

korethr wrote: post #80

Backups. I cannot emphasize enough the importance of backups. Take backups, verify your ability to restore from them, and keep them segregated from the rest of your infrastructure. It doesn't matter how inelegant and hacky your backup solution is, so long as you can restore from it. Any backup you can restore from is better than no backup. You might get a call from one of your application engineers shortly before bed…

I think we should make every sysadmin watch Mr.Robot, at the least the first season. That may drive home the point: secure backups are important. ;)

And don’t restore your cloned image using clonezilla whilst on morphine. It’s hard enough to use whilst sober.

Re: The ransomware surge

#216

Post by beermonster » Sat, May 08, 2021, 9:09 PM UTC

unstatusthequo wrote: post #186

korethr wrote: post #80

Backups. I cannot emphasize enough the importance of backups. Take backups, verify your ability to restore from them, and keep them segregated from the rest of your infrastructure. It doesn't matter how inelegant and hacky your backup solution is, so long as you can restore from it. Any backup you can restore from is better than no backup. You might get a call from one of your application engineers shortly before bed…

Backups are nice. Until threat actor deletes them or encrypts them. Backups are also nice until you realize they exfiltrated data too. They are one mitigation but definitely not a sure fire insurance against a data breach and legal implications thereof. Source: I’m a cybersecurity lawyer.

Backups should be on a different segregated network (ideally off-site) with strict access controls and encryption. The threat actor should not just be able to find them lying about (possible even directly attached) with no authentication or authorisation required to access them. If they are able to access them somehow then they shouldn’t be readable. What you describe is people with a poor backup policy, which yeah I guess describes most folk. But backups aren’t the issue here, poor backups are.

And they do not mitigate against the threat of the data being published online which seems to be the new(ish) threat these days with ransomeware.