SoylentNews is people
SoylentNews
from the getting-the-horses-back-after-closing-the-barn-doors dept.
Why you can't bank on [just] backups to fight ransomware anymore:
[...] [The] belief that no personally identifying information was breached in [a] ransomware attack is common among victims of ransomware—and that's partially because ransomware operators had previously avoided claiming they had access to victims' data in order to maintain the "trust" required to extract a payment. Cyber insurance has made paying out an attractive option in cases where there's no need for an organization to reveal a breach, so the economics had favored ransomware attackers who provided good "customer service" and gave (usually believable) assurances that no data had been taken off the victims' networks.
Unfortunately, that sort of model is being blown up by the Maze and Sodinokibi (REvil) ransomware rings, which have adopted a model of using stolen data as leverage to ensure customers will make a payment. Even in cases where a victim can relatively quickly recover from a ransomware attack, they still will face demands for payment in order to avoid the publication or sale of information stolen by the attackers before the ransomware was triggered.
Maze and REvil are targeted ransomware attacks that break from the established norm of ransomware attacks in other ways. Telling users not to click on email attachments and to recognize phishing sites isn't stopping these attackers from getting in. Both have relied on exploits of known weaknesses in Internet-facing infrastructure of their victims—be it an Oracle WebLogic vulnerability, a long-ago patched weakness in Pulse Secure VPN servers, or hacks of managed service providers' systems.
Being able to quickly get back up and running after a breach is a very good thing. It is also not enough. Preventing attackers from exfiltrating confidential information is likely more difficult and potentially more costly. Especially since Europe enacted GDPR (General Data Protection Regulation) and some other jurisdictions in the US have enacted laws requiring prompt disclosure and notification after a breach.
(Score: 2) by edIII on Monday February 10 2020, @12:10AM (1 child)
Define "winning" here.
If winning is suffering no damage, no financial penalties, no loss of public perception, then winning is impossible.
Backups, specifically those are incremental, store different versions of data, are definitely still enough to fight ransomware. If you define winning as still having access to clean data after the attack, and the ability to restore operations quickly.
If you redefine ransomware to include extortion using exfiltrated data, than not only backups are rendered failed strategies. You can just easily say, "strong application firewalls" are no longer enough to fight ransomware.
Technically, lunchtime is at any moment. It's just a wave function.
(Score: 4, Informative) by sjames on Monday February 10 2020, @12:37AM
If the bad guys got code onto your network with sufficient access to encrypt all of your files, all bets are off as far as data leaks are concerned whether they throw in some extortion of not. That might be their backup plan, or perhaps they intend to sell off customer data for an extra paycheck (even if they do extort you about data release and you pay, crooks aren't always honest, ho figure).