Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
We keep hearing of big enterprises (Garmin, Edeka) being taken out of business for days or weeks, due to ransomware encryption attacks.
One would assume that it can't be that hard to create versioned backups that can't be overwritten from the system that created them. (After all, most consumer-grade NAS can do it.) So, what am I missing, how is ransomware more than a nuisance?
You reference Garmin, so let's look at that:
"cyber criminals targeted Garmin with a ransomware attack that encrypted the company’s internal systems and shut down critical services"
"online services were interrupted including website functions, customer support, customer-facing applications, and company communications."
For large companies, we are not simply talking about end user files being encrypted, like Word and Excel files, but backup files and VM files. These are not typically backed up since they tend to be huge and a modern large company will have thousands of them, which makes it too difficult to copy and store on tape somewhere.
If all VMs are encrypted, and AD, backup systems, DNS, etc. are on those VMs, you have no means of logging in to anything to start a restore.
In addition, before files get encrypted, attackers tend to want to control the backup system in order to delete or corrupt the backup files in order to prevent their use in recovery.
In addition, in large companies, if there are off-site tape backups, they can take time to recover and the data might be old enough that there will be financial harm if they are used instead of trying to recover more recent data. Even a couple of day's worth of data can represent millions of lost revenue.
So, the question is not "how can we get a better backup?" but rather, "how can we limit how far an attacker can worm into our company and limit the blast radius?" Backups help, but they are not a total solution.
Restoring data from backup is a manual process, it can be very tedious and take a long time. And you are always going to lose something, not every data is saved in real time but more like in daily snapshots. Workstations will most likely have to be reinstalled from scratch.
Imagine a large organization with hundreds or thousands of workstations. Even with extensive automation, PXE boot provisioning etc - you are not going to fix the problem in 5 minutes. And that assumes you have competent personnel at hand which is not a granted. Reminds me of Aramco. Look it up.
The bigger problem lies elsewhere: data leaks. By the time the ransomware is actioned, lots of sensitive data may have been exfiltrated by the attackers. Which after all is the essence of ransomware: pay up or we release all your data on the public Internet (or darknet).
Sure, you can restore the data on your end (maybe) but once it's out you can't take it back.
