CloudNordic has told customers to consider all of their data lost following a ransomware infection that encrypted the large Danish cloud provider's servers and "paralyzed CloudNordic completely," according to the IT outfit's online confession.
The intrusion happened in the early-morning hours of August 18 during which miscreants shut down all of CloudNordic's systems, wiping both company and customers' websites and email systems. Since then, the IT team and third-party responders have been working to restore punters' data — but as of Tuesday, it's not looking great.
"Not looking great" means that it was wiped clean. This is a good time to remind everyone about the importance of backing up your data. It sounds like a pain, but you only need to back up the data you don't want to lose ...
12 comments:
I just don't know how crap IT companies manage to screw this stuff up so bad.
How hard is it to have one or more backup servers that have NO services open (i.e. there is no way to connect to the backup servers via SSH, RDP, etc...) and the backup servers "reach out" to take backups.
All my client data is backed up off-site.
The backup servers have *no* services running that open a listening network port.
There are *no* services on the box that allow any sort of remote execution (i.e. a config management tool that reaches out and listens to commands from a central server).
The backups are fully-encrypted with keys that I *don't have*. They aren't even on the client systems. Backups occur without decrypting the data.
The only way to access the box is by physically walking up to it and connecting a keyboard, mouse, and monitor.
The box fires off a cron job every few hours and establishes an SSH session to the remote client machines and *pulls* down a copy of their backups. Those backups are rotated and kept around for ~90 days.
It's not that damned difficult if you are competent.
I guess finding competent IT companies is the difficult part.
Two is one and one is none. Firearms, magazines, data backups, etc.
"The cloud" is a lot like fiatbux vs. money in that regard.
If you ain't got the real thing in your own hand, you ain't got the real thing in your own hand.
As ever was.
Thus the other name for "cloud" is "fart in the wind".
What Aesop said.
I have despised CLOUD ever since they started pushing it.
I don't consider it safe for even my shopping list.
Two sayings come to mind. To discourage someone from putting their most precious memories "in the cloud," instead call it "someone else's computer somewhere else." That they have no control over.
To emphasize the problem, the quote from that famous bank robber Willie Sutton when asked why he robbed banks. "Because that's where the money is." Cloud services attract hackers to attack them because that's where they're likely to find things that are interesting to them.
One never realizes how poor their backup strategy is until they need to restore all of their lost data. I have been asked more than once if I can somehow magically recover data from a broken disk drive.
Never fear. I am certain that the FBI and the CIA have a complete backup of that data. All of which is kiddie porn!
"you only need to back up the data you don't want to lose", but which data is that? You mean I have to sort through this mountain of garbage and pick out the few little bits that are actually important? Gaaaah!
Back up your data to REMOVABLE MEDIA and unplug it from the computer when NOT ACTUALLY IN USE. It's called "AIRGAPPING." Hackers can't get what they can't get to!
An oopsie that not good. External drives, thumb drives, and gotten off site is the way I do it. Nothing backed up to the 'cloud' (read somebody else's computer).
Cloud = someone else's computer.
This will be prevented in 3-2-1
Three copies, on two different media, with one copy offsite.
The onsite and offsite backup copies should be stored in immutable fashion.
There's even a book on it, for which I was one of the technical reviewers:
https://www.oreilly.com/library/view/modern-data-protection/9781492094043/
Kurt
Post a Comment