Or sufficiently backed up, right? If you’ve got a backup and quick recovery process ransomware is impotent.

Nowadays the attackers will threaten to disclose the sensitive data publicly, as they did in this case. So ensuring your own access to your data, i.e. backups, is not the only concern. It's still important, of course.

This is by far the cheapest solution.

unless your data is legally required to stay confidential under HIPPA or similar law. Then a backup just keeps you operating but not immune to the threat of data publication.

What data needs to be confidential in the case of the Colonial Pipeline?

I'm sure that there's proprietary data. Maybe knowing how much oil / gasoline is flowing might allow some traders to make unfairly informed trades (or maybe not: only inside trading is illegal. If someone figures out the information some other way, its not illegal IIRC).

And maybe employee data should be kept private, but there's no HIPPA requirement on that. Its not like there's payment processors on this thing either, so no PCI compliance here.

So I'm not exactly seeing why backing up data would be an issue in this case.

While the threat of publication is a risk, the data has already been breached and you are no longer compliant with the law.

I wonder if companies still get fined if the data is just encrypted without any exfil

Not quite. The attacker still got access to the system in some way. They may have a permanent backdoor now and opportunity for messing with your backup operation.

If hackers take the slow route, all backups may be encrypted too. Or at least, compromised.

Also, backups are often taken but rarely is their actual recoverability tested.

Nah. It will never stop.

The problem is information density.

So long as billions of records that are needed for the business exist in a device the size of a shoebox, we’re fucked. An insider can always take the shoebox, lock the shoebox, etc.

Three stories of paper files in file cabinets can’t be ransomed short of a physical bomb threat.

Don’t know what the solution is. But I do know the problem. Exfiltrarion is similar: the odd quirk of technology that has enabled these massive thefts is the ability to load millions of pages in a few seconds into a thumb drive. Odd pickle we’ve got ourselves into.

Your metaphor works both ways: the ability to fit billions of records in a shoebox means that it’s perfectly manageable to keep another shoebox as a backup, under independent control.

So now there are two shoeboxes. Hasn’t solved exfiltration. In fact, you’ve just doubled the risk.

There may not be a solution if the problem is untrustworthy people.

The custodians of your ‘independent control’ will eventually get ransomwared themselves.

Then what?

It’s like cash... If you are a sophisticated criminal, do you waste time burglarizing individuals? Or, do you rob the bank where the individuals keep their money for ‘safekeeping’?

How many people at Amazon have access to the database other companies use to store info?

2? 20? 200?

I don’t know, but I bet it’s a lot. And I doubt they get paid enough to make them immune to a generous offer (or a scary threat) from a bad guy.

Seriously, how many individuals at Amazon have the ability — if they wanted - to irreparable corrupt, encrypt, or destroy data?

I thought we were talking about denying access to important files. Data exfiltration is a different threat model than what I was addressing.

There is a part of me that would like to go back to the way we dud business before the internet, and computers.

I think three daily encrypted backups mandated by law would be enough to stop the multi-million dollar ransoms.

We will still see companies paying ransom for a business days loss, but not complete shutouts? And infrastructure specific operations, like this pipe line, should be air gapped.

It’s good practice for a cash business to make daily runs to deposit daily at the bank. Stupid to leave cash laying in the till overnight.

Which is why thieves rob banks.

But, money is fungible... if it’s stolen, it can be replaced. If the bank can’t replace it without going broke, the FDIC steps in and, essentially, prints more money to make you whole (up to a point.)

But, data is unique and irreplaceable.

If everyone is backing up to a smaller and smaller number of ‘cloud’ companies, it’s just centralizing the problem... putting everyone’s eggs in one basket.

Some ransomware is time-delayed because of this, so it isn't clear which backup is still untainted.

And if the penalty for hacking systems for malicious purpose goes up.

Hopefully every member of DarkSide ends up in court if they're US or friendly nation citizens or in Gitmo otherwise