The Dever Ransomware Experience

Re:The Dever Ransomware Experience by hanklazard on Sunday February 23, 2020 @06:17PM (#22400261)

Fantastic write-up, I really enjoyed all of the details on how the forensics are done for these cases. Certainly a good reminder to make frequent air-gapped backups of any mission-critical machines on the network. And even with those, as the author points out, rebuild time and effort could be horrible.

Steve Gibson has been heavily covering the increase in ransomeware on his excellent podcast Security Now. From SN I’ve learned some interesting points, including that Ransomeware-as-a-Service is now definitely a thing. There have been a few major operations which hand out ransomeware packages to unethical hackers in exchange for a % of the Bitcoin they collect.

I can only see ransomeware becoming more and more of a problem in the future, though I certainly hope I’m wrong.

[ Parent | on HN ]

Re:The Dever Ransomware Experience by rectang on Sunday February 23, 2020 @07:49PM (#22400682)

As an industry, to mitigate such risks over the long term, we have to move to continuous restoration, which will require innovation in workflows, tools, and services.

I also think that we've begun a reassessment of just how much information needs to be stored, because "Data is a toxic asset." A lot of these systems have data they don't need mixed in with mission-critical data, which raises the complexity of restoration.

[ Parent | on HN ]