Cyber attacks- Are you protecting your data? And how?

What with the latest ransom malware attack showing the ability to strike business, are you concerned about your data? Cyber hackers have shown the willingness to go after even relatively small targets. The creation of the Bitcoin and extreme difficulty in tracking the attacks have made the chance of apprehension and punishment very well worthwhile considering the possible payoff. Attacks will become more creative and pervasive. What are your thoughts and defensive strategy?

Most of the stuff I save "on the hard drive" I might welcome a chance to be rid of it.

The important stuff is on "off the internet" computers and removable hard drives.

One defensive strategy is to use Apple computers rather than PC's. There is a much larger installed base for the PC platform than Apple, so more potential targets for Cyber criminals.

This strategy won't work well in the case of "phishing", but for other kinds of attacks, yes.

I've used both and find the Mac to be better in almost every respect anyway. But, I don't want to start a Mac vs PC war. Just sayin...others Wil disagree.

Cheers,

Squire

Sent Using Tapatalk - Cherokee Nation of Oklahoma, Tahlequah OK

In the way back days you would make tape backups every day and the manager would take one home in case the building caught on fire.
This was SOP for just about everybody in the mini and beginning micro days.
If your non-net machines burn what then. Are the odds higher of a fire, disk crash or like or a cyber attack?
Been doing this computer communication stuff since before it was called the internet. Have had more than a few times I wished I had backed up a drive that failed, seen a shop lose all their cnc programs, prints, quotes and customer info to a fire.

Now we have the cloud thingee as a backup. Some don't trust it but it's a easy option.
Some bigger places set out honey pots to get an advance warning when people come poking around.
Increasing attacks and the fear spread by the media means more good paying jobs for guys with white hats so maybe good for the economy.
Who would of thought that you could get paid six figures just to sit at a desk and watch internet traffic go by.
Bob

I have several back ups of all my cadcam and important files and back up each new die design. I also do not leave the back up drives plugged into the online computer as an attack could compromise both the computer and all the drives plugged into it.

Has anyone attempted to install the backups that they are making?

Many of them have a rather poor success rate.

norb said:

I have several back ups of all my cadcam and important files and back up each new die design. I also do not leave the back up drives plugged into the online computer as an attack could compromise both the computer and all the drives plugged into it.

Click to expand...

False security, won't work, ask Iran. No network access, no physical connection ever to the net, isolated machines...yet...oops.
You have to plug in that backup drive at some point to make the backup. Then I have access. I can wait.
Few of these things attack immediately. Some wait for a very long time, some rewrite themselves months later if removed by your virus scan.
Any decent hack is gonna sit dormant for a while so that people won't know where it came from.
Exposing yourself out front would be foolish as others would be warned and not download you. You want to hide, maybe ping your owner once in a while so he/she knows you are ready. Not implement the code the scanner will find until the right moment when the scanner can not stop you.
One should never have only one backup as it may be sitting inside your backup waiting for the right date.
Kidee scripts are one thing, the heavy duty stuff is not written by amateurs and no system is immune.
Come to Vegas and Def Con 25. Vegas is a fun town and you get to see some insane geeks. Just don't bring your wireless laptop or phone or your "secure" CAD/CAM at home may never be the same.

Gobo said:

What with the latest ransom malware attack showing the ability to strike business, are you concerned about your data? Cyber hackers have shown the willingness to go after even relatively small targets. The creation of the Bitcoin and extreme difficulty in tracking the attacks have made the chance of apprehension and punishment very well worthwhile considering the possible payoff. Attacks will become more creative and pervasive. What are your thoughts and defensive strategy?

Click to expand...

Backups of backups of backups. I'm sure there's an official word for it, but we use a "cascading" backup approach. Daily, every pc of concern backs itself up to a network storage location. Also daily, the server runs a script that does a robocopy clone of the shared network onto a separate physical drive. Weekly that physical drive is rotated out and replaced with an identical alternate. The removed drive is stored offsite for the week. We do a similar but different setup for just CAD data only. Main difference is the offsite version is never more than 24 hrs out of sync. The offsite storage is contracted with a service provider about 30 miles away that has a brick and mortar storefront staffed with real life human beings, I don't like call centers.

Besides backups, and backups are the absolute first / must have line of defense, I run a pfsense firewall with intrusion detection (Snort). My approach with firewalls is to lock everything down and only open up individual ports as people cry about them. That way I can usually tag a note about for who and why any given port is open.

I'll be the first to admit that I regularly drop the ball on checking firewall logs, forcing people to change passwords, and keeping OS's properly patched. But it's at least some comfort that if we're to be hit with ransomware somehow, I do have access to backups.

Ziggy2 said:

Has anyone attempted to install the backups that they are making?

Many of them have a rather poor success rate.

Click to expand...

Heh, heh, this is an IT truism. "Backups never fail; only restores fail."

Ziggy2 said:

Has anyone attempted to install the backups that they are making?

Many of them have a rather poor success rate.

Click to expand...

This is a great point that's often overlooked. In fact, this is why I don't do full system / state backups of the client PC's on our network anymore. Restoring those type of backups seemed to create much more of a headache than restoring basic file & folder backups. I don't try to capture every little aspect of a persons profile, screensaver, display resolution, browser history, etc. I point my backups to only what I know I absolutely have to have, which usually has nothing to do with windows system files. 90% of the time, backing up a users My Documents and an e-mail store (.pst usually) is all I need. We used to run full nuts to bolts system state backups and store them on tape drives, Yosemite I think. Restoring from those types of backups never once went as straight forward as it should have, and it was expensive to boot. Since having changed to only backing up user folders, I've never once had an instance where I wished I had a full system state backup to work with. When only dealing with files and folders I have a lot more options for usable backup media as well. YMMV.

El Mustachio said:

This is a great point that's often overlooked. In fact, this is why I don't do full system / state backups of the client PC's on our network anymore. Restoring those type of backups seemed to create much more of a headache than restoring basic file & folder backups. I don't try to capture every little aspect of a persons profile, screensaver, display resolution, browser history, etc. I point my backups to only what I know I absolutely have to have, which usually has nothing to do with windows system files. 90% of the time, backing up a users My Documents and an e-mail store (.pst usually) is all I need. We used to run full nuts to bolts system state backups and store them on tape drives, Yosemite I think. Restoring from those types of backups never once went as straight forward as it should have, and it was expensive to boot. Since having changed to only backing up user folders, I've never once had an instance where I wished I had a full system state backup to work with. When only dealing with files and folders I have a lot more options for usable backup media as well. YMMV.

Click to expand...

Best way to go when you KNOW what is in the environment, yes. ISTR WinWOES had abut 70,000 "drivers" in .cab files alone before I ceased to care. No backup needed, faster and safer malware scans if they - and about 2/3'rds of the other trash Win installs with itself - were REMOVED from an active machine once configured.

Did a few where "RAID 1" mirror sets had three elements, rather than two.

Trained the gal clerk/receptionist to rotate the pull-out SCSI trays last thing each day before locking-up, set the "Friday" and "Friday of Fridays" aside. Scripts performing a continuous detection exercise did the rest. Separate system checked their health wee-hours, could page more expert hands to the site before the next workday opened.

Fast-forward ten-plus years, had Matt Dillon and the then-current code maintainer make a minor tweak to 'cpdup' source code, ran it out the backside, rack-side, internal use NIC amongst RAID 1 servers over 10GigE on IPV6. Cycled at an odd number of seconds from each end to reduce risk of collisions or costly overlaps.

Large, but rapid set of hand-shaking transactions - really lean as to data, per-each - then seldom more than a handful of files to actually copy, run at sub ten-second intervals as it was.

Slower clone ran an off-continent 'cpdup' at a lower data rate, stayed about one-full day back, worst case.

No actual 'restore' operation visible to end users in either case.

Simple replacement of a failed mirror-set member or server, entire, then background automagical rebuilds.

Current report.
There are only two data conservation and recovery outcomes.

Success.
To maintain your data, worship, daily, at the altar of Apple, whose God, Squier-Jobs, protects your data, from beyond from the grave, if you make the required, regular, voti$$$$ve offerings, and offer gigasacrifi$$$$ces at the fiery pillar of NonInterchangeableFeaturesWhichAreAlwaysImprovementsButNaturallyTheyAreVeryExpensive.

Failure.
ManyBackupFailuresAllegedButAllAnecdotal-NoStatisticalEvidenceWhatsoeverAdduced, the God of ineluctable, permanent, data disappearance, rejoices in your downfall. His exalted servants, Ziggy the infallible and Carbide the truculent, laugh while your data floats away on the oceans of tears you cry as your precious bits dissolve into the marine abyss.
Ha Ha.

ManicMetalBasher said:

Current report.
There are only two data conservation and recovery outcomes.

Success.
To maintain your data, worship, daily, at the altar of Apple, whose God, Squier-Jobs, protects your data, from beyond from the grave, if you make the required, regular, voti$$$$ve offerings, and offer gigasacrifi$$$$ces at the fiery pillar of NonInterchangeableFeaturesWhichAreAlwaysImprovementsButNaturallyTheyAreVeryExpensive.

Failure.
ManyBackupFailuresAllegedButAllAnecdotal-NoStatisticalEvidenceWhatsoeverAdduced, the God of ineluctable, permanent, data disappearance, rejoices in your downfall. His exalted servants, Ziggy the infallible and Carbide the truculent, laugh while your data floats away on the oceans of tears you cry as your precious bits dissolve into the marine abyss.
Ha Ha.

Click to expand...

Theo de Raadt & disciples, are of course not even offering to hold your beer, nor really paying a lot of attention to what is in-play on 'any of the above' tribes of cesspools anyway.

We don't HAVE to..

From what I've heard, most of the attacks have been in China because most computers in China run a pirated version of Windows and cannot get updates.

Hard to feel sorry for them.

ewlsey said:

From what I've heard, most of the attacks have been in China because most computers in China run a pirated version of Windows and cannot get updates.

Hard to feel sorry for them.

Click to expand...

Phhht... "Sorry?" No Fine Way!

The latest Microsnot code that hadn't yet been formally released was traded every day, "Golden" Shopping centre, HKG, 25 years ago and 'somewhere' still-yet, Police raids notwithstanding.

PRC Gov was officially OPPOSED to Windows, tried to flog 'Red Flag Linux' instead.

Suspicion was that MS - and perhaps three-letter US Gov Agencies - turned a blind-eye to piracy until WinWOES was so deeply entrenched in PRC by ever-reliable human gullibility, greed, and sloth that they had a guaranteed market PLUS assured easy penetration targets all over PRC, many Gov't agencies included.

Banks, utilities, transport, and Military were smarter and/or more heavily scrutinized. "Strategic National Asset" as a concept must first have been put into words somewhere in China, and thousands of years before computers.

Bank of China is a far harder target than most US banks are.

The general population is just too busy, and/or too LAZY to DO updates, same as most 'mericans that run personal WinWoes boxen.

Looks worse only because they have far the larger 'headcount', even with fewer 'puters per-head.

Monarchist said:

Phhht the latest Microsnot code that hadn't yet been formally released was traded every day, "Golden" Shopping centre, HKG.

They are just too LAZY to DO updates, same as most 'mericans that run personal WinWoes boxen.

Looks worse only because they have far the larger 'headcount', even with fewer 'puters per-head.

Click to expand...

Your eloquent explanations make me feel so much better.

The real risk here is ignorance. Many users do not do backups, do not update their hardware and software or follow due diligence for multiple reasons. For individuals, refreshing their hardware and software is easy to do. Many organizations have a very difficult time acquiring the budget to do this. This cost is seen as competition to many other organizational requirements and often viewed as optional and not a must fund item by ill informed bean counters and senior illiterate decision makers. It should be well understood that illegal and pirated software is not a cost savings, but it isn't. The real cost of software is the invested time to learn how to use it, not the cost of a use license. It is these folks that have been affected and I have no sympathy.