News for hackers. Stuff that matters.

A comment on The ransomware surge. Parent comment

Re:The ransomware surge by tomrod on Friday April 30, 2021 @06:30PM (#27000304)
> No, the automatic 7 day RDS snapshots or turning on S3 versioning is not a sufficient backup. Neither is mirroring to a S3 Glacier bucket in the same org, or rsyncing to a a backup server in the same datacenter.

Why?

[ Parent | on HN ]
Re:The ransomware surge by danielheath on Friday April 30, 2021 @06:48PM (#27000503)
A few reasons come to mind.

If you lose control of an aws root account it can take weeks to get it back. That’s probably enough time for the hackers to clean out the backups.

Billing issues can lead to aws wiping out an account.

For $work the backups are in AWS but using a different payment method, account owner etc to prevent cross contamination. Honestly, they should be outside aws entirely, but separate accounts is a good start.

[ Parent | on HN ]
Re:The ransomware surge by viraptor on Friday April 30, 2021 @08:13PM (#27001380)
> If you lose control of an aws root account it can take weeks to get it back.

> Billing issues can lead to aws wiping out an account.

These are small-scale related issues though. When you're at the level where it's hard to have a reasonable backup outside of AWS, you can also resolve the root account issues fairly quickly by calling your TAM directly.

[ Parent | on HN ]
Re:The ransomware surge by tooltower on Friday April 30, 2021 @06:40PM (#27000419)
Because they share the failure domain. In all of those cases, there's a single point of failure.
[ Parent | on HN ]