News for hackers. Stuff that matters.
Re:Ask HN: What is the most common security mistake you see? by atmosx on Tuesday May 23, 2017 @11:40AM (#14402128)
Lack of working backups. It's appalling how many people depend on systems with no backups.

Forget ransomware and other exotic attacks, what happens if after 7 years your hard drive decides to die on you?

I don't know. The backup is the first thing that needs to be setup and tested when you buy a computer. Windows and Mac have build-in systems for point-in-time backups and linux offers more than a few solutions.

Backup, backup and backup again :-)

Re:Ask HN: What is the most common security mistake you see? by ghughes on Tuesday May 23, 2017 @12:19PM (#14402513)
This advice doesn't seem to be getting through regardless of how loudly it is proclaimed. Everyone should have a backup plan with multiple points of failure, but of course lots of people don't because it's not trivial to set that up.

I don't think current operating systems go anywhere near far enough in helping users to get this right. When I buy a computer, the computer should be in charge of ensuring that catastrophic data loss cannot easily occur. 9 times out of 10, the user simply doesn't know how to set things up that way.

Re:Ask HN: What is the most common security mistake you see? by stephenr on Thursday May 25, 2017 @03:58AM (#14415959)
On a Mac it prompts on external hdd being connected, you click a button and its setup. How much simpler can it be ?
Re:Ask HN: What is the most common security mistake you see? by Bladtman on Tuesday May 23, 2017 @12:07PM (#14402392)
I agree entirely with the sentiments here, but I wouldn't consider it a security issue. A safety issue more like.
Re:Ask HN: What is the most common security mistake you see? by taeric on Tuesday May 23, 2017 @03:33PM (#14404461)
Security for software is typically defined to include things that protect you from loss of access risks. Think the latest ransomware that went out.

Specifically, the axes of security are integrity, authentication, and availability. Backups give the illusion of helping both integrity and availability. However, without practiced and verified recovery plans, they do neither.

Re:Ask HN: What is the most common security mistake you see? by taeric on Tuesday May 23, 2017 @12:05PM (#14402366)
Agreed. Disaster recovery is one of those things that everyone agrees needs to be possible. But nobody seems to realize that you are only good at the things you regularly do.

Which isn't fair of me. I think people do realize it. Just making the time to regularly repeat something you have done before is tough.

I am very sympathetic to the idea that you can automate this. However, this seems to typically fall afoul of the idea that you now just have more that can and will fail. So now you need something to monitor that....

Re:Ask HN: What is the most common security mistake you see? by jrs235 on Tuesday May 23, 2017 @12:39PM (#14402722)
Not just backups. Restores. You need to test your backups by periodically testing your restore process to ensure the backups are actually any good.

Test your restore process periodically!

Re:Ask HN: What is the most common security mistake you see? by decasia on Tuesday May 23, 2017 @03:21PM (#14404331)
Server backups are pretty easy to test in this era of virtualization. (I know, not everyone does it, but at least in principle it's pretty straightforward to mount a duplicate VM and test one's backed-up data. Good way to test config management systems as well.)

But how does one test restoring personal data? I'm guessing that most people, like me, don't buy duplicate laptops just to be a platform for testing their data restoration protocols.

Re:Ask HN: What is the most common security mistake you see? by webtechgal on Tuesday May 23, 2017 @02:07PM (#14403611)
> It's appalling how many people depend on systems with no backups.

Truer words were seldom written!!