Conversation

Notices

1. SwiftOnSecurity (swiftonsecurity@infosec.exchange)'s status on Saturday, 07-Jan-2023 07:54:27 JST SwiftOnSecurity

   Note it is very common to hear that even if you pay the ransom, the decryption may not fully work. Ransomware is unusual software doing very unusual things to files it doesn't own. It will screw things up on production systems. There is no alternative to good backups.
   https://www.malwarebytes.com/blog/news/2023/01/software-provider-denied-insurance-payout-after-ransomware-attack

   • Andreas (ixs@mastodon.bawue.social)'s status on Saturday, 07-Jan-2023 07:54:25 JST Andreas

     in reply to

     • Fish Id Wardrobe

     @fishidwardrobe @SwiftOnSecurity
     Always worth going into a bit more detail there.

     Online or offline does not really matter that much.

     What is important is that you have enough retention time to get data back. So a single snapshot is not enough, but a weekly archive going back a year probably is enough.

     The other question is if your backup server is reachable and can be wiped.

     If e.g. your backup server is somewhere completely offsite, doesn't use SSO or other shared auth and only pulls snapshots via rsync you might be safe.

     If it's a nice storage server inside your usual infrastructure and nicely integrated, you're probably fscked because your backups just got encrypted as well.

   • Fish Id Wardrobe (fishidwardrobe@mastodon.me.uk)'s status on Saturday, 07-Jan-2023 07:54:26 JST Fish Id Wardrobe

     in reply to

     @SwiftOnSecurity *offline* backups. They will wait until your online backups are infected and catch those, too. (Personal experience, here.)

     Adrian Cochrane repeated this.