Hacker News Reader

Comment by Dalewyn | Hacker News Reader

Because backups are exceedingly tedious and cost tons of money.

Many people and organizations decide it's cheaper to not spend money against a potential threat or risk, and to their credit it is in fact cheaper.

That is, of course, until the threat or risk becomes real rather than potential. Suddenly you have Lady Luck staring you down at your front door, invoice in hand demanding immediate payment of principal and all interest accrued.

Incidentally, this is why (at least at the consumer level) cloud storage and backups have become so prominent and in many cases forcefed by hardware, software, and service providers: Because it's hands-free and cheap data security for most consumers. Unfortunately, this doesn't always scale to large enterprise organizations.

View on HN

Governments can fund counter-terrorist teams to take out terrorists and bank robbers, and have a whole complicated infrastructure of water to deal with fires, but paying someone to copy files into a briefcase every day is too expensive.

Back-ups are also not going to save you if the infection is time-delayed.

Then you confused backups for replication and don't understand how business continuity planning / disaster recovery work.

I think they mean the scenario where the attacker sneaks in and adds a persistent backdoor / sets up privileged accounts for themselves to use / generally makes themselves comfortable, and then sits on their thumbs for a long period of time before activating the ransomware. If the victim restores from the previous day / week / months backup, the attacker can then sneak right back in and re-exploit whatever vulnerability.

The proposition then becomes "Our last non-compromised (as far as we know) backup is half a year old, can we afford to lose months of progress, or should we just pay the ransom?".

Or perhaps the attacker doesn't have a persistent foothold, but can make a credible claim that they do - do you take the risk? Keeping in mind that every moment you burn investigating and trying to discover the extent of the compromise is another moment you're down and burning money.

You're conflating offsite data backups with some sort of system backups. Then you have to start over with fresh, sterile, secured systems and good data by having multiple, regular data backups. Don't bother trying undo compromised systems because you'll never win that game.

I'm not following. Are you implying that malware can't infect data and remain undetected?

You might have a good backup from say a week ago which is great to recover from but then you still have to sift out what may have been compromised transaction-wise if the attackers were clever in hiding their attack

That's not how reimaging compromised systems and restoring only data works.

Reply on news.ycombinator.com