Tarsnap, while optimal for essential, mainline data, it really needs a file-based QoS feature where it can use or migrate to/from cheaper options like RRS or Glacier.
If anyone could make it work it's Dr. Percival, but I wouldn't want to be the one trying to figure out how to avoid astronomical charges for hydrating and transferring data, or accidentally making too many calls.
Yep. Where it only lives temporarily exposed from an on-prem HSM in some extra-security "no go" caged area, and the the unlock passphrase is split into 2 pieces spread amongst managers and senior engineers.
Because backups are exceedingly tedious and cost tons of money.
Many people and organizations decide it's cheaper to not spend money against a potential threat or risk, and to their credit it is in fact cheaper.
That is, of course, until the threat or risk becomes real rather than potential. Suddenly you have Lady Luck staring you down at your front door, invoice in hand demanding immediate payment of principal and all interest accrued.
Incidentally, this is why (at least at the consumer level) cloud storage and backups have become so prominent and in many cases forcefed by hardware, software, and service providers: Because it's hands-free and cheap data security for most consumers. Unfortunately, this doesn't always scale to large enterprise organizations.
You might have a good backup from say a week ago which is great to recover from but then you still have to sift out what may have been compromised transaction-wise if the attackers were clever in hiding their attack
I think they mean the scenario where the attacker sneaks in and adds a persistent backdoor / sets up privileged accounts for themselves to use / generally makes themselves comfortable, and then sits on their thumbs for a long period of time before activating the ransomware. If the victim restores from the previous day / week / months backup, the attacker can then sneak right back in and re-exploit whatever vulnerability.
The proposition then becomes "Our last non-compromised (as far as we know) backup is half a year old, can we afford to lose months of progress, or should we just pay the ransom?".
Or perhaps the attacker doesn't have a persistent foothold, but can make a credible claim that they do - do you take the risk? Keeping in mind that every moment you burn investigating and trying to discover the extent of the compromise is another moment you're down and burning money.
You're conflating offsite data backups with some sort of system backups. Then you have to start over with fresh, sterile, secured systems and good data by having multiple, regular data backups. Don't bother trying undo compromised systems because you'll never win that game.
Governments can fund counter-terrorist teams to take out terrorists and bank robbers, and have a whole complicated infrastructure of water to deal with fires, but paying someone to copy files into a briefcase every day is too expensive.
DR/BCP is harder now than it was with cloud storage and SaaS making it more difficult, but not impossible.
Every business-critical system and service, including every user account used, first needs to be inventoried and then inventoried on an ongoing basis.
With that, data can be roughly sized and classified with a business impact analysis - "How much money do we lose if X?".
From that, backup jobs/agents, retention schedules, and other forms of mitigation investments can be made.
PS: It's heartening to see CommVault is still in business.
EDIT: I once bought a FireKing smaller 3-hour data safe and implemented a barcoded LTO GFS policy using Iron Mountain as the offsite vaulting vendor. Sadly, FK no longer make safes for tape media anymore. It looks like IBM/HPE/Quantum LTO-9 tapes and drives are about the only games in town, and around $80 for 18 TB making them half the gross cost of circular spinning rust. Amazon's Glacier uses low-speed circular spinning rust like Facebook does for colder storage.
Oh yeah[1], it's a simple concept... a single directional optical link. Laser --> Photodiode.
You set up 2 servers on either side of it, and you mirror the data across the link, repeating the state of the buffer with forward error correction.
A typical use would be to allow remote monitoring an industrial control system, collecting logs, etc. The data diode assures data can egress, but control can never ingress.
> According to the president, Indonesia's central and regional governments together operate a fleet of 27,000 apps, many of which overlap or aren't integrated.
As an Indonesian working as a software developer, I can say that integration is more akin to a jargon than something actually planned and properly implemented here in Indonesia. The apps number continue to grow because almost every time the head of an institution changes (on whatever level it is), the new one would be more likely to create a new app from scratch as a form of achievement.
42 comments
[ 3.4 ms ] story [ 99.6 ms ] threadThat ain't no backup
Also, Amazon Glacier is a pretty cool service, and it's incredibly cheap.
but first, offline full backups that get tested.... why doesn't anyone do this any more?
Many people and organizations decide it's cheaper to not spend money against a potential threat or risk, and to their credit it is in fact cheaper.
That is, of course, until the threat or risk becomes real rather than potential. Suddenly you have Lady Luck staring you down at your front door, invoice in hand demanding immediate payment of principal and all interest accrued.
Incidentally, this is why (at least at the consumer level) cloud storage and backups have become so prominent and in many cases forcefed by hardware, software, and service providers: Because it's hands-free and cheap data security for most consumers. Unfortunately, this doesn't always scale to large enterprise organizations.
The proposition then becomes "Our last non-compromised (as far as we know) backup is half a year old, can we afford to lose months of progress, or should we just pay the ransom?".
Or perhaps the attacker doesn't have a persistent foothold, but can make a credible claim that they do - do you take the risk? Keeping in mind that every moment you burn investigating and trying to discover the extent of the compromise is another moment you're down and burning money.
Every business-critical system and service, including every user account used, first needs to be inventoried and then inventoried on an ongoing basis.
With that, data can be roughly sized and classified with a business impact analysis - "How much money do we lose if X?".
From that, backup jobs/agents, retention schedules, and other forms of mitigation investments can be made.
PS: It's heartening to see CommVault is still in business.
EDIT: I once bought a FireKing smaller 3-hour data safe and implemented a barcoded LTO GFS policy using Iron Mountain as the offsite vaulting vendor. Sadly, FK no longer make safes for tape media anymore. It looks like IBM/HPE/Quantum LTO-9 tapes and drives are about the only games in town, and around $80 for 18 TB making them half the gross cost of circular spinning rust. Amazon's Glacier uses low-speed circular spinning rust like Facebook does for colder storage.
You set up 2 servers on either side of it, and you mirror the data across the link, repeating the state of the buffer with forward error correction.
A typical use would be to allow remote monitoring an industrial control system, collecting logs, etc. The data diode assures data can egress, but control can never ingress.
[1] https://en.wikipedia.org/wiki/Unidirectional_network
!?