Hit by Ransomware Attack, Florida City Agrees to Pay Hackers $600k

Re:Hit by Ransomware Attack, Florida City Agrees to Pay Hack... by jjav on Thursday June 20, 2019 @01:38AM (#20230208)

A very good solution here is ZFS. Office file server runs ZFS and makes regular ZFS snapshots (hourly, or more often). Snapshots are immutable so even if the employee machines get infected, nothing can be lost (except the last N minutes since the last snapshot). Obviously, still have to do backups (off of those snapshots).

[ Parent | on HN ]

Re:Hit by Ransomware Attack, Florida City Agrees to Pay Hack... by equalunique on Thursday June 20, 2019 @09:57AM (#20232962)

I absolutely love ZFS, but I think it's only a piece of the puzzle necessary for mitigating this threat. In terms of data integrity, I sure hope no system running ZFS would have it's snapshots also corrupted, but if that did happen, then hopefully those ZFS snapshots would have been backed up to some offline media like tape or optical disk. Example: http://girlyngeek.blogspot.com/2014/02/zfs-on-read-only-devi...

[ Parent | on HN ]

Re:Hit by Ransomware Attack, Florida City Agrees to Pay Hack... by eeZah7Ux on Thursday June 20, 2019 @06:29AM (#20231457)

> Snapshots are immutable so even if the employee machines get infected

Not really. You can easily extract data and overwrite the disk surface.

[ Parent | on HN ]

Re:Hit by Ransomware Attack, Florida City Agrees to Pay Hack... by jjav on Thursday June 20, 2019 @05:16PM (#20237473)

Not from the machines which typically get infected, which are the employee desktops accessing the file server.

If the malware manages to get itself running on the file server itself (and with root privileges), then sure. That's not a common case though.

[ Parent | on HN ]

Re:Hit by Ransomware Attack, Florida City Agrees to Pay Hack... by amelius on Thursday June 20, 2019 @06:33AM (#20231471)

What if the malware puts itself between the hardware and the filesystem?

[ Parent | on HN ]