Hacker News Reader

Comment by user3939382 | Hacker News Reader

Or sufficiently backed up, right? If you’ve got a backup and quick recovery process ransomware is impotent.

Nowadays the attackers will threaten to disclose the sensitive data publicly, as they did in this case. So ensuring your own access to your data, i.e. backups, is not the only concern. It's still important, of course.

This is by far the cheapest solution.

unless your data is legally required to stay confidential under HIPPA or similar law. Then a backup just keeps you operating but not immune to the threat of data publication.

What data needs to be confidential in the case of the Colonial Pipeline?

I'm sure that there's proprietary data. Maybe knowing how much oil / gasoline is flowing might allow some traders to make unfairly informed trades (or maybe not: only inside trading is illegal. If someone figures out the information some other way, its not illegal IIRC).

And maybe employee data should be kept private, but there's no HIPPA requirement on that. Its not like there's payment processors on this thing either, so no PCI compliance here.

So I'm not exactly seeing why backing up data would be an issue in this case.

While the threat of publication is a risk, the data has already been breached and you are no longer compliant with the law.

I wonder if companies still get fined if the data is just encrypted without any exfil

Not quite. The attacker still got access to the system in some way. They may have a permanent backdoor now and opportunity for messing with your backup operation.

If hackers take the slow route, all backups may be encrypted too. Or at least, compromised.

Also, backups are often taken but rarely is their actual recoverability tested.

Reply on news.ycombinator.com